Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CWE CATEGORY:ICS Dependencies (& Architecture): External Digital Systems
Category ID:1368
Vulnerability Mapping:Prohibited
Status:Incomplete
DetailsContent HistoryObserved CVE ExamplesReports
▼Summary

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

▼Membership
NatureMappingTypeIDName
MemberOfProhibitedV1358Weaknesses in SEI ETF Categories of Security Vulnerabilities in ICS
HasMemberProhibitedB1068Inconsistency Between Implementation and Documented Design
HasMemberProhibitedC1059Insufficient Technical Documentation
HasMemberAllowedB1104Use of Unmaintained Third Party Components
HasMemberAllowedB1329Reliance on Component That is Not Updateable
HasMemberAllowed-with-ReviewC1357Reliance on Insufficiently Trustworthy Component
HasMemberAllowedB1393Use of Default Password
HasMemberAllowedB15External Control of System or Configuration Setting
HasMemberDiscouragedC287Improper Authentication
HasMemberAllowedB306Missing Authentication for Critical Function
HasMemberAllowedB308Use of Single-factor Authentication
HasMemberAllowedB312Cleartext Storage of Sensitive Information
HasMemberAllowedB440Expected Behavior Violation
HasMemberAllowedB470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
HasMemberAllowedB603Use of Client-Side Authentication
HasMemberDiscouragedC610Externally Controlled Reference to a Resource in Another Sphere
HasMemberAllowed-with-ReviewC638Not Using Complete Mediation
Nature: MemberOf
Mapping: Prohibited
Type: View
ID: 1358
Name: Weaknesses in SEI ETF Categories of Security Vulnerabilities in ICS
Nature: HasMember
Mapping: Prohibited
Type: Base
ID: 1068
Name: Inconsistency Between Implementation and Documented Design
Nature: HasMember
Mapping: Prohibited
Type: Class
ID: 1059
Name: Insufficient Technical Documentation
Nature: HasMember
Mapping: Allowed
Type: Base
ID: 1104
Name: Use of Unmaintained Third Party Components
Nature: HasMember
Mapping: Allowed
Type: Base
ID: 1329
Name: Reliance on Component That is Not Updateable
Nature: HasMember
Mapping: Allowed-with-Review
Type: Class
ID: 1357
Name: Reliance on Insufficiently Trustworthy Component
Nature: HasMember
Mapping: Allowed
Type: Base
ID: 1393
Name: Use of Default Password
Nature: HasMember
Mapping: Allowed
Type: Base
ID: 15
Name: External Control of System or Configuration Setting
Nature: HasMember
Mapping: Discouraged
Type: Class
ID: 287
Name: Improper Authentication
Nature: HasMember
Mapping: Allowed
Type: Base
ID: 306
Name: Missing Authentication for Critical Function
Nature: HasMember
Mapping: Allowed
Type: Base
ID: 308
Name: Use of Single-factor Authentication
Nature: HasMember
Mapping: Allowed
Type: Base
ID: 312
Name: Cleartext Storage of Sensitive Information
Nature: HasMember
Mapping: Allowed
Type: Base
ID: 440
Name: Expected Behavior Violation
Nature: HasMember
Mapping: Allowed
Type: Base
ID: 470
Name: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Nature: HasMember
Mapping: Allowed
Type: Base
ID: 603
Name: Use of Client-Side Authentication
Nature: HasMember
Mapping: Discouraged
Type: Class
ID: 610
Name: Externally Controlled Reference to a Resource in Another Sphere
Nature: HasMember
Mapping: Allowed-with-Review
Type: Class
ID: 638
Name: Not Using Complete Mediation
▼Vulnerability Mapping Notes
Usage:Prohibited
Reason:
Rationale:

This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.

Comments:

See member weaknesses of this category.

▼Notes
Relationship

Relationships in this category are not authoritative and subject to change. See Maintenance notes.

N/A

Maintenance

This category was created in CWE 4.7 to facilitate and illuminate discussion about weaknesses in ICS with [REF-1248] as a starting point. After the release of CWE 4.9 in October 2022, this has been under active review by members of the "Boosting CWE" subgroup of the CWE-CAPEC ICS/OT Special Interest Group (SIG). Relationships are still subject to change. In addition, there may be some issues in [REF-1248] that are outside of the current scope of CWE, which will require consultation with many CWE stakeholders to resolve.

N/A

▼Taxonomy Mappings
Taxonomy NameEntry IDFitEntry Name
▼References
Reference ID: REF-1248
Title: Categories of Security Vulnerabilities in ICS
Version: v4.15
Author: Securing Energy Infrastructure Executive Task Force (SEI ETF)
Publication:
Publisher:
Edition:
URL:https://inl.gov/wp-content/uploads/2022/03/SEI-ETF-NCSV-TPT-Categories-of-Security-Vulnerabilities-ICS-v1_03-09-22.pdf
URL Date:
Day:09
Month:03
Year:2022
Details not found