SDL and the CWE/SANS Top 25
Bryan here. The security community has been buzzing since SANS and MITRE’s joint announcement earlier this month of their list of the Top 25 Most Dangerous Programming Errors. Now, I don’t want to get into a debate in this blog about whether this new list will become the new de facto standard for analyzing security vulnerabilities (or indeed, whether it already has become the new standard). Instead, I’d like to present an overview of how the Microsoft SDL maps to the CWE/SANS list, just like we did with the SDL/OWASP Top Ten mapping last May.
Michael and I have written up a detailed item-by-item analysis of the SDL coverage of the Top 25 and posted it on the microsoft.com Download Center. We believe that the results tend to endorse the validity of the SDL, given that the Top 25 were developed independently and the SDL does quite well at enabling us to root them out of the software we deliver. We encourage you to download the analysis white paper and make use of it in your own organization: we’ve published guidance around every manual process described in the paper, and we’ve also made many of the same SDL-required security tools that we use internally free for you to download and use as well.
Below is a summary of how the SDL maps to the Top 25 vulnerabilities; as you can see the SDL covers every one of the Top 25 vulnerabilities, and all but two of them (race conditions and download of code without integrity check) are covered by multiple SDL requirements. I’m also particularly pleased to note that we have tools to prevent or detect more than 75% of the Top 25.
|
CWE |
Title |
Education? |
Manual Process? |
Tools? |
Threat Model? |
|
20 |
Improper Input Validation |
Y |
Y |
Y |
Y |
|
116 |
Improper Encoding or Escaping of Output |
Y |
Y |
Y |
|
|
89 |
Failure to Preserve SQL Query Structure (aka SQL Injection) |
Y |
Y |
Y |
|
|
79 |
Failure to Preserve Web Page Structure (aka Cross-Site Scripting) |
Y |
Y |
Y |
|
|
78 |
Failure to Preserve OS Command Structure (aka OS Command Injection) |
Y |
|
Y |
|
|
319 |
Cleartext Transmission of Sensitive Information |
Y |
|
|
Y |
|
352 |
Cross-site Request Forgery (aka CSRF) |
Y |
|
Y |
|
|
362 |
Race Condition |
Y |
|
|
|
|
209 |
Error Message Information Leak |
Y |
Y |
Y |
|
|
119 |
Failure to Constrain Memory Operations within the Bounds of a Memory Buffer |
Y |
Y |
Y |
|
|
642 |
External Control of Critical State Data |
Y |
|
|
Y |
|
73 |
External Control of File Name or Path |
Y |
Y |
Y |
|
|
426 |
Untrusted Search Path |
Y |
|
Y |
|
|
94 |
Failure to Control Generation of Code (aka 'Code Injection') |
Y |
Y |
|
|
|
494 |
Download of Code Without Integrity Check |
|
|
|
Y |
|
404 |
Improper Resource Shutdown or Release |
Y |
|
Y |
|
|
665 |
Improper Initialization |
Y |
|
Y |
|
|
682 |
Incorrect Calculation |
Y |
|
Y |
|
|
285 |
Improper Access Control (Authorization) |
Y |
Y |
|
Y |
|
327 |
Use of a Broken or Risky Cryptographic Algorithm |
Y |
Y |
Y |
|
|
259 |
Hard-Coded Password |
Y |
Y |
Y |
Y |
|
732 |
Insecure Permission Assignment for Critical Resource |
Y |
Y |
|
|
|
330 |
Use of Insufficiently Random Values |
Y |
Y |
Y |
|
|
250 |
Execution with Unnecessary Privileges |
Y |
Y |
|
Y |
|
602 |
Client-Side Enforcement of Server-Side Security |
Y |
|
|
Y |
