 |
 |
 |
 |
| |
|||||
|
|
|
Home > News & Events > Media Relations > News Releases > | |||||||||||||||
Top 25 Most Dangerous Software Errors List Released FOR IMMEDIATE RELEASE: MITRE Contacts: Karina H. Wright Eryn L. Gallagher MCLEAN, Va., July 6, 2011 — The MITRE Corporation, the SANS Institute, and other leading security experts from across the United States and Europe have released a list of the 25 most significant software errors that can lead to serious application vulnerabilities. Accompanying the list is the release of two new software security scoring systems, which allow organizations to craft their own list of top software security errors based upon their specific business needs and the types of applications used within their work. The 2011 list was announced at an event sponsored by the U.S. Department of Homeland Security held June 27 at MITRE's McLean, Va., campus. The top 25 most dangerous software errors, which can lead to security holes and enable online espionage and cyber crime, are common mistakes made in the process of developing software—not the vulnerabilities that surface after the software has reached the market. Such programming errors occur frequently and are easy to exploit. The Top 25 list aims to stop vulnerabilities at the source by educating programmers on how to eliminate all-too-common mistakes before software is shipped. With the introduction of the two new software security scoring systems—one for use in assessing a specific application and one for considering the priorities of a collection of applications within a technology focus or a specific business domain—software consumers have options. They can either use the general Top 25 list or they can create one tailored to how their organization uses software and the types of software failures that are of the most concern. Also, software managers and CIOs can use the Top 25 list or one of the new scoring systems to measure progress and gain focus in their efforts to secure their software. The list leverages experiences gained in the development of MITRE's Common Weakness Enumeration (CWE™) (https://cwe.mitre.org/). MITRE maintains the CWE website, with the support of the U.S. Department of Homeland Security's National Cyber Security Division, presenting detailed descriptions of the top 25 software errors along with guidance for mitigating and avoiding them. The CWE site also contains data on more than 860 additional programming errors, design errors, and architecture errors that can lead to exploitable vulnerabilities. The list and other supporting information can be accessed at https://cwe.mitre.org/top25/. The two scoring systems, the Common Weakness Scoring System (CWSS™) and the Common Weakness Risk Analysis Framework (CWRAF™), can be accessed at https://cwe.mitre.org/cwss/ and https://cwe.mitre.org/cwraf/, respectively. About The MITRE Corporation The MITRE Corporation (www.mitre.org) is a not-for-profit organization that provides systems engineering, research and development, and information technology support to the government. It operates federally funded research and development centers for the Department of Defense, the Federal Aviation Administration, the Internal Revenue Service and Department of Veterans Affairs, the Department of Homeland Security, and the Administrative Office of the U.S. Courts, with principal locations in Bedford, Mass., and McLean, Va.
Page last updated: July 19, 2011 | Top of page |
Solutions That Make a Difference.® |
|
|
