2010 CWE–SANS Top 25 Most Dangerous Programming Errors

“The list is the result of collaboration between the SANS
Institute, MITRE, and many top software security experts in the US
and Europe. It leverages experiences in the development of the SANS
Top 20 attack vectors (http://www.sans.org/top20/) and MITRE’s
Common Weakness Enumeration (CWE) (http://cwe.mitre.org/). MITRE
maintains the CWE web site, with the support of the US Department
of Homeland Security’s National Cyber Security Division, presenting
detailed descriptions of the top 25 programming errors along with
authoritative guidance for mitigating and avoiding them. The CWE
site contains data on more than 800 programming errors, design
errors, and architecture errors that can lead to exploitable
vulnerabilities.

“The 2010 Top 25 makes substantial improvements to the 2009
list, but the spirit and goals remain the same. The structure of
the list has been modified to distinguish mitigations and general
secure programming principles from more concrete weaknesses. This
year’s Top 25 entries are prioritized using inputs from over 20
different organizations, who evaluated each weakness based on
prevalence and importance. The new version introduces focus
profiles that allow developers and other users to select the parts
of the Top 25 that are most relevant to their concerns. The new
list also adds a small set of the most effective “Monster
Mitigations,” which help developers to reduce or eliminate entire
groups of the Top 25 weaknesses, as well as many of the other 800
weaknesses that are documented by CWE. Finally, many high-level
weaknesses from the 2009 list have been replaced with lower-level
variants that are more actionable.”

Complete Story