ITU-T X 1524-2012 Common weakness enumeration (Study Group 17)《通用缺陷列表 17号研究组》.pdf

1、 International Telecommunication Union ITU-T X.1524TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (03/2012) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Cybersecurity information exchange Vulnerability/state exchange Common weakness enumeration Recommendation ITU-T X.1524 ITU-T

2、X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.699 OSI MAN

3、AGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATIONS AND SERVICES

4、 Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1200X.1229 C

5、ountering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 CYBERSECURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerability/state exchange X.1520X.1539Event

6、/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.1580X.1589 For further details, please refer to the list of ITU-T Recommendations. Rec. ITU-T X.1524 (03/2012) i R

7、ecommendation ITU-T X.1524 Common weakness enumeration Summary Recommendation ITU-T X.1524 on the use of the common weakness enumeration (CWE) provides a structured means to exchange information security weaknesses that provides common names for publicly known problems in the commercial or open sour

8、ce software used in communication networks, end user devices, or any of the other types of information and communications technology (ICT) capable of running software. The goal of CWE is to enable more effective discussion, description, selection, and use of software security tools and services that

9、 can find these weaknesses in source codes and operational systems as well as better understanding and management of software weaknesses related to architecture and design. This Recommendation defines the use of CWE to provide a mechanism for software security tools, services, knowledge bases and ot

10、her capabilities to be used together, and to facilitate the comparison of security tools and services. CWE also offers supportive context information about possible risks, impacts, fix information, and detailed technical information about what the software weaknesses could mean to a software system.

11、 History Edition Recommendation Approval Study Group 1.0 ITU-T X.1524 2012-03-02 17 ii Rec. ITU-T X.1524 (03/2012) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication technologies (ICTs).

12、The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Stan

13、dardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of informatio

14、n technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. C

15、ompliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. The words “shall“ or some othe

16、r obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that the practice or implem

17、entation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendation development process.

18、 As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest information and are therefore strongly ur

19、ged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2012 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1524 (03/2012) iii Table of Contents Page 1 Scope 1 2 References. 1

20、3 Definitions 1 3.1 Terms defined elsewhere 1 3.2 Terms defined in this Recommendation . 1 4 Abbreviations and acronyms 2 5 Conventions 3 6 High-level requirements . 3 7 Accuracy . 4 8 Effectiveness . 5 9 Documentation 5 10 CWE version usage. 5 11 Revocation of CWE compatibility . 6 12 Review author

21、ity . 7 Annex A Type-specific requirements . 8 A.2 Tool requirements . 8 A.3 Security service requirements . 9 A.4 Online capability requirements . 9 Annex B Media requirements . 11 B.3 Electronic documents (HTML, word processor, PDF, ASCII text, etc.) . 11 B.4 Graphical user interface (GUI) . 11 Ap

22、pendix I List of CWE repositories for identifiers and the associated context information . 12 Appendix II List of review authorities 13 Bibliography. 14 iv Rec. ITU-T X.1524 (03/2012) Introduction The common weakness enumeration (CWE) Recommendation describes the use of CWE, a structured means to ex

23、change unified, measurable sets of software weaknesses that aims to provide common names for publicly known problems. The goal of CWE is to make it easier to enable more effective discussion, description, selection, and use of software security tools and services that can find these weaknesses in so

24、urce code and operational systems as well as to promote better understanding and management of software weaknesses related to architecture and design. The intention of CWE is to be comprehensive with respect to the causes behind all publicly known vulnerabilities and exposures, whether from weakness

25、es in the softwares architecture, design, code, or deployment. While CWE is designed to contain mature information, the primary focus is on identifying the weaknesses that can cause vulnerabilities and exposures. The review authority determines conformance on the use of CWE identifiers, as defined i

26、n this Recommendation. CWE gives leverage to existing work from within the cybersecurity community such as the large number of diverse real-world vulnerabilities specified in Recommendation ITU-T X.1520 Common vulnerabilities and exposures (CVE). Many sources and examples are leveraged to develop th

27、e specific and succinct definitions of the CWE list elements and classification tree structures. In addition, appropriate mappings are created between CWEs and CVE names so that each CWE identifier has a list of the specific CVE names that belong to that particular CWE category of software security

28、weaknesses. In constructing the CWE list and classification tree, maximum comprehensive coverage across appropriate conceptual, business, and technical domains is sought. This Recommendation is technically equivalent to and compatible with the “Requirements and Recommendation for CWE Compatibility a

29、nd Effectiveness“, version 1.0, dated July 28, 2011 https:/cwe.mitre.org/compatible/requirements_v1.0.html. Rec. ITU-T X.1524 (03/2012) 1 Recommendation ITU-T X.1524 Common weakness enumeration 1 Scope This Recommendation on the use of the common weakness enumeration (CWE) provides a “structured mea

30、ns“ for the global exchange of information about software security weaknesses in architecture, design, code, or deployment that can make software systems insecure, unreliable and vulnerable to attack. Security tools, assessment services, and some types of security reviews can detect these types of s

31、oftware weaknesses. This “structured means“ is often referred to as “CWE Compatibility“ and defines the correct use of CWE. An information security weakness is a mistake in the software that could result in a vulnerability that can be used by a hacker to gain access to a system or network. The assig

32、nment of CWE identifiers is not within the scope of this Recommendation. A list of repositories for CWE identifiers and the associated context information is available in Appendix I. The intention of CWE, the use of which is defined in this Recommendation, is to be comprehensive with respect to the

33、software architecture, design, coding, and deployment errors that are the root causes of vulnerabilities and exposures. While CWE is designed to contain mature information, the primary focus is on identifying, educating, and describing these root causes of vulnerabilities and exposures so they can b

34、e avoided by developers, tested for, and managed by development teams as well as consistently reported by security tools and services. This Recommendation is technically equivalent to and compatible with the “Requirements and Recommendation for CWE Compatibility and Effectiveness“, version 1.0, date

35、d July 28, 2011 https:/cwe.mitre.org/compatible/requirements.html. 2 References None. 3 Definitions 3.1 Terms defined elsewhere None. 3.2 Terms defined in this Recommendation This Recommendation defines the following terms: 3.2.1 accuracy percentage: The percentage of security elements in the review

36、 sample that reference the correct CWE identifiers. 3.2.2 capability: An assessment tool, Integrated Development Environment (IDE), code review tool, code checking compiler, database, website, advisory, or service that provides information about implementation, design, or architecture-level weakness

37、es that can lead to an exploitable security vulnerability in software. 2 Rec. ITU-T X.1524 (03/2012) 3.2.3 CWE compatibility requirements evaluation form: This evaluation form contains a series of questions asking the capabilitys owner to document their conformance to the compatibility requirements

38、of Recommendation ITU-T X.1524 in text, image or web references, as well as instructions on where to submit the completed form or to ask the review authority for clarification on how to complete the evaluation form. 3.2.4 CWE effectiveness requirements evaluation form: This evaluation form contains

39、a series of questions asking the capabilitys owner to document their conformance to the effectiveness requirements of this Recommendation in text, image or web references, as well as instructions on where to submit the completed form, request tests, or to ask the review authority for clarification o

40、n how to complete the evaluation form. 3.2.5 effectiveness testing: The process of determining whether a capability is CWE effective. 3.2.6 map/mapping: The specification of relationships between weakness elements in a repository and the CWE items that are related to those elements. 3.2.7 owner: The

41、 custodian (real person or company) having responsibility for the capability. 3.2.8 repository: An implicit or explicit collection of security-related software weakness elements that supports a capability, e.g., a database of security weaknesses, the set of patterns in a code analyser, or a website.

42、 3.2.9 review: The process of determining whether a capability is CWE-compatible. 3.2.10 review authority: An entity that performs a review or effectiveness testing and is authorized to grant CWE-compatible or CWE-effective status. Note that Appendix II contains a list of review authorities. 3.2.11

43、review version: The dated version of CWE that is being used for determining the CWE compatibility or CWE effectiveness of a capability. 3.2.12 security element: A database record, assessment probe, signature, etc., that is related to a specific security weakness. 3.2.13 task: A tools probe, check, s

44、ignature, etc., that performs some action that produces security information (i.e., the security element). 3.2.14 test results: Data representing the outcome of effectiveness testing. 3.2.15 tool: A software application or device that examines a piece of software, binary, or other artefact and produ

45、ces information about security weaknesses, e.g., a source code security analyser, a code quality assessment tool, code checking compiler or a development environment. 3.2.16 user: A consumer or potential consumer of the capability. 3.2.17 vulnerability: Any weakness in software that could be exploit

46、ed to violate a system or the information it contains (based upon b-ITU-T X.1500). 3.2.18 weakness: A shortcoming or imperfection in the software code, design, architecture, or deployment that, could, at some point become a vulnerability, or contribute to the introduction of other vulnerabilities. 4

47、 Abbreviations and acronyms This Recommendation uses the following abbreviations and acronyms: ASCII American Standard Code for Information Interchange CCR Coverage Claim Representation CGI Common Gateway Interface Rec. ITU-T X.1524 (03/2012) 3 CWE Common Weakness Enumeration GUI Graphical User Inte

48、rface HTML Hypertext Markup Language HTTP Hypertext Transfer Protocol ICT Information and Communications Technology PDF Portable Document Format POC Point of Contact URL Uniform Resource Locator XML Extensible Markup Language 5 Conventions None. 6 High-level requirements The following items define t

49、he concepts, roles, and responsibilities related to the proper use of CWE identifiers to share data across separate security weakness capabilities, (tools, repositories, and services) to allow these security weakness capabilities to be used together, and to facilitate the comparison of security weakness tools and services. 6.1 The capability owner shall be a valid legal entity, i.e., an organization or a specific individual, with a valid phone number, email address, and street mail address. 6.2 The capability shall provide additi