The impact of these errors is far reaching. Just two of them led to more than 1.5 million web site security breaches during 2008 - and those breaches cascaded onto the computers of people who visited those web sites, turning their computers into zombies.
People and organizations that provided substantive input to the project are listed below. They are among the most respected security experts and they come from leading organizations ranging from Symantec and Microsoft, to DHS's National Cyber Security Division and NSA's Information Assurance Division, to OWASP and the Japanese IPA, to the University of California at Davis and Purdue University. The MITRE and the SANS Institute managed the Top 25 Errors initiative, but the impetus for this project came from the National Security Agency and financial support for MITRE's project engineers came from the US Department of Homeland Security's National Cyber Security Division.
Until now, most guidance focused on the 'vulnerabilities' that result from programming errors. This is helpful. The Top 25, however, focuses on the actual programming errors, made by developers that create the vulnerabilities.
2009 CWE/SANS Top 25 Most Dangerous Programming Errors
Document version: 1.0 - download in PDF formatTable of contents:
• Brief Listing of the Top 25
• Construction and Selection of the Top 25
• Organization of the Top 25
• Insecure Interaction Between Components
• Risky Resource Management
• Porous Defenses
• Appendix A: Selection Criteria and Supporting Fields
• Appendix B: Threat Model for the Skilled, Determined Attacker
• Appendix C: Other Resources for the Top 25