Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


First question on here so please be as gentle as you can :-)

I've been looking around for any writings or papers on a standard for classifying vulnerabilities. Not from a severity/risk/impact point of view but categorising such as grouping all the 'missing patches', 'weak authentication management', egress/ingress rules for networks and alike. Now I know that plenty of people have done this work already, myself included. What I am interested to know is if anyone has done something on a more formal/standard footing?

Long question, all responses warmly welcomed.

share|improve this question
Hi @IC3N1, welcome to the site! – AviD Jun 7 '11 at 16:13
up vote 6 down vote accepted

MITRE has a few systems for this. CVE for things that need patching; CWE for bugs that need to be avoided/fixed, CAPEC describing attacks to your infrastructure; CCE for configuration needs; CPE for a proper naming scheme; and CEE for event exchange information.

You'll find links to other resources that work along with MITRE's standards or are similar in nature to them.

share|improve this answer
Yup, I was going to point to MITRE, though it seems that CWE is more what the OP was looking for... – AviD Jun 9 '11 at 14:12
Just as a follow up - MITRE looks like it is my friend. Many thanks. – IC3N1 Jun 14 '11 at 8:36

The OWASP top ten categorisation is exactly this kind of thing. Admittedly, they have chosen to dramatically shrink scope to just the top ten attack types.

share|improve this answer
OWASP Top 10 is good for those that it includes, and OWASP has a larger library of common vulnerabilities (though I guess not as formalized as MITRE's), mostly donated by Fortify and Aspect (so take them with certain amount of sodium chloride...) – AviD Jun 9 '11 at 14:13
Rory, thanks for the answer. Although the OWASP list gives good coverage of the common vulnerabilities it is by it's very nature web centric. For my needs I wanted a broader set of categories and I think MITRE's work looks closer to my needs. – IC3N1 Jun 14 '11 at 8:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.