The 25 Most Dangerous Software Errors Putting Your Data at Risk

The Common Weakness Enumeration (CWE) recently published its list of the top 25 Most Dangerous Software Errors (CWE Top 25), which include the most widespread and critical weaknesses that can lead to serious vulnerabilities in software. Even more ominous is the fact that these weaknesses are often easy to find and even easier to exploit – and can allow adversaries to completely take over execution of software, steal data or prevent the software from working.

CWE has provided this list as a community resource for use by software developers, software testers, software customers, software project managers, security researchers and educators to provide insight into some of the greatest security threats in the software industry.

This list was compiled with support from the Department of Homeland Security, which noted that it is vital for software designers, developers and cybersecurity experts to keep apprised of the potential weakness that software errors present. The Homeland Security Systems Engineering and Development Institute (HSSEDI), which is managed by DHS Science and Technology Directorate (S&T), and operated by MITRE, recently updated the 25 CWE list for the first time in eight years.

HSSEDI provided the specialized independent and objective expertise for addressing national homeland security needs in a number of vital areas, including those in information technology, communications and cybersecurity.

“This list is an important tool for improving cybersecurity resiliency,” said Scott Randels, Director of S&T’s Federally-Funded Research and Development Centers, which manages HSSEDI, via a statement.

“I’m excited about our ongoing collaboration with HSSEDI and the vast mitigation potential of this product,” added Randels.

More Than a Guidance Document

The 2019 CWE list is meant to serve as a guidance document, but also as an important proof-of-concept, as it was compiled via a data-driven approached based on real-world vulnerabilities reported by security researchers.

“We shifted to a data-driven approach because it enables a more consistent and repeatable analysis that reflects the issues we are seeing in the real world,” said CWE project leader Chris Levendis via a release. “We will continue to mature the methodology as we move forward.”

Experts in the field have both praised the CWE list, but also highlighted the failure of the software community to address the vulnerabilities

“From a software perspective, this list looks right,” said Javvad Malik, security awareness advocate at KnowBe4, via an email. “However, much like other similar lists, such as the OWASP top 10, there is little change in the overall types of vulnerabilities which constantly make up the top issues.”

In other words, the industry needs to do more to help ensure that the software doesn’t put users in harm’s way.

“This highlights the unfortunate reality that despite many efforts, security is not being embedded effectively enough within the developer community, or in enterprise assurance frameworks,” added Malik. “It’s not that we are unaware of how to identify and remedy the issues or prevent them from occurring in the first place, there appears to be a culture where getting software shipped outweighs the security requirements.”

Top 2019 Threats

While many of the threats have been common – even all too common – for many years, the 2019 CWE list specifically identified a new top weakness: “Improper Restriction of Operations within Bounds of a Memory Buffer,” and this replaced the previous top weakness, “Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’),” which dropped down to the number six spot.

However, just as the CWE list calls out specific threats, all Americans should still be aware that software itself is just one part of the great issue of cybersecurity.

“Seventy to ninety percent of all malicious compromises are due to social engineering and exploiting unpatched software is involved in 20% to 40%,” explained Roger A. Grimes, data-driven defense evangelist at KnowBe4, via an email to ClearanceJobs.

“You would think that all software developers would be getting better at developing code with less exploitable security vulnerabilities,” added Grimes.

Some are, but most are not.

“This shouldn’t be surprising because most programmers are not taught about computer security and secure development lifecycle (SDL) programming techniques and processes in school,” Grimes explained.

“There are only a few colleges in the U.S. that devote an entire course on computer security and secure program to programmers,” Grimes noted. “Most cover it in a few hours as part of some other course, which of course means that it isn’t really covered.”

More worrisome is that bad actors also know that software weaknesses remain such a prevalent issue.

“News like this is encouraging to attackers as even lesser-skilled ones know that without advanced techniques or custom malware abilities, they can still take advantage of age-old flaws to breach many companies,” said Malik.

The answer is – or at least should be – a fairly straightforward one where understanding security is as important as coding.

“All programmers should strive to learn as much as they can about SDL techniques, tools, and processes as they can,” said Grimes. “It will make them better programmers and more valuable to their employers. Best yet, they’ll get paid more and make more secure software for the world. It’s win-win.”

Here’s the list of the top 25 software weaknesses, and the overall score of each: