Structured Approach to Classifying Security Vulnerabilities, A

Understanding vulnerabilities is critical to understanding the threats they represent. Vulnerabilities classification enables collection of frequency data; trend analysis of vulnerabilities; correlation with incidents, exploits, and artifacts; and evaluation of the effectiveness of countermeasures. Existing classification schemes are based on vulnerability reports and not on an engineering analysis of the problem domain. In this report a classification scheme that uses attribute-value pairs to provide a multidimensional view of vulnerabilities is proposed. Attributes and values are selected based on engineering distinctions that allow vulnerabilities to be exploited by a given technique or determine which countermeasures are effective. Successful classification of vulnerabilities should lead to greater automation in analyzing code vulnerabilities and supporting effective communication between geographically remote vulnerability handling teams and vendors.

PDF [577 KB]

Authors

Robert C. Seacord

Allen D. Householder

This report is related to the following area(s) of work:

Security and Survivability

Technical Note
CMU/SEI-2005-TN-003
January 2005

Cite This Report

SEI:

Seacord, Robert; & Householder, Allen. Structured Approach to Classifying Security Vulnerabilities, A (CMU/SEI-2005-TN-003). Software Engineering Institute, Carnegie Mellon University, 2005. http://www.sei.cmu.edu/library/abstracts/reports/05tn003.cfm

IEEE:

R. Seacord, and A. Householder, "Structured Approach to Classifying Security Vulnerabilities, A," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Technical Note CMU/SEI-2005-TN-003, 2005. http://www.sei.cmu.edu/library/abstracts/reports/05tn003.cfm

APA:

Seacord, R., & Householder, A. (2005). Structured Approach to Classifying Security Vulnerabilities, A (CMU/SEI-2005-TN-003). Retrieved May 21, 2013, from the Software Engineering Institute, Carnegie Mellon University website: http://www.sei.cmu.edu/library/abstracts/reports/05tn003.cfm

CHI:

Seacord, Robert, and Allen Householder. Structured Approach to Classifying Security Vulnerabilities, A (CMU/SEI-2005-TN-003). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2005. http://www.sei.cmu.edu/library/abstracts/reports/05tn003.cfm

MLA:

Seacord, R., & Householder, A. 2005. Structured Approach to Classifying Security Vulnerabilities, A (Technical Report CMU/SEI-2005-TN-003). Pittsburgh: Software Engineering Institute, Carnegie Mellon University. http://www.sei.cmu.edu/library/abstracts/reports/05tn003.cfm

Find Us Here

Find us on Youtube  Find us on LinkedIn  Find us on twitter  Find us on Facebook

Share This Page

Share on Facebook  Send to your Twitter page  Save to del.ico.us  Save to LinkedIn  Digg this  Stumble this page.  Add to Technorati favorites  Save this page on your Google Home Page 

For more information

Contact Us

info@sei.cmu.edu

412-268-5800

Help us improve

Visitor feedback helps us continually improve our site.

Please tell us what you
think with this short
(< 5 minute) survey.