I am trying to make the link between faults and weaknesses (As defined by Common Weaknesses Enumeration, a MITRE project). The word "fault" is generally used in the reliability domain, to designate the cause of an error i.e., the cause of the deviation from a correct service delivered by a system to an incorrect service.

The word "weakness" is widely used in the cybersecurity community, however, its meaning is not always clear. From my readings, a weakness is defined as a mistake in software that, in proper conditions, could contribute to the introduction of vulnerabilities within that software. A vulnerability being the occurrence of a weakness in a system.

As I wrote, I am trying to put into relation these two concepts (faults and weaknesses), to create a relation between reliability and security. From my observations, it is fair to say that a weakness is caused by a fault. When you consider a weakness such as "incorrect privilege assignment", it is clear that this could happen only because of a bad development of your system, which can be classified as a development fault. In my opinion, if a development fault is not a weakness (i.e., cannot lead to any vulnerability), it means that the part of your system where the fault resides is not useful, hence could be removed.

My question is: are all development faults weaknesses? Else, do you have a concrete counterexample?

Thanks for your help.

  • I don't think these are standard terms. A weakness could easily mean any security measure which is not performing optimally, not necessarily a result of mistakes in software. It is used informally. There are other terms which have formal definitions, like incident, event, attack, threat, etc. – forest Dec 11 '18 at 9:26
  • The definition I gave you come from CVE and CWE. The word "weakness" is widely used in SP series (NIST standard for information security) and ISO27000 series. And many definitions in the glossary of these standards rely on the word "weakness". So this is a pretty standard term I would say. An incident, threat, attack ... are terms that are not directly related to my question. All are used to express and intentional or unintentional way to exploit a vulnerability (security speaking). edit: did not mean to offend you but it is strange that this word is "informal" when it is so broadly used. – Ecterion Dec 11 '18 at 9:30
  • My point is that there is no one meaning unless are asking how it is defined according to a specific standard. So yes, "weakness" is widely used in information security, but unless you specify a standard, it means many things. – forest Dec 11 '18 at 9:33
  • 1
    I get your point, I will precise the above text in that case. – Ecterion Dec 11 '18 at 9:36
  • 1
    Related: security.stackexchange.com/questions/192080/…. Also faults are a subset of weaknesses see here – Tom K. Dec 11 '18 at 12:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.