risk
Vulnerabilities introduced during software development
Inherent weaknesses in programming languages and development environments introduce errors and exploitable vulnerabilities into software products, and software malfunctions cause incorrect outputs, crashes, or security weaknesses.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- category
- cyber_security
- domain
- Secure Development (SDLC) & Application Security
- Vulnerability & Patch Management
- taxonomy
- nist-800-30-threat-event
- iso-27005-threat
- inherent_rating
- high
Details
- risk_id
- sdlc-vulnerabilities-in-software
- category
- cyber_security
- likelihood
- high
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- nist-800-30-threat-event
- iso-27005-threat
Source
No record-specific source URL is provided.
Connections
- UC-SDLC-05 — Enforce secure coding and input validation standards mitigates Vulnerabilities introduced during software development
- strength
- primary
- rationale
- Enforced secure-coding standards plus code review and static analysis before release directly remove exploitable coding weaknesses.
- UC-VULN-07 — Harden runtime error handling, output filtering, and memory mitigates Vulnerabilities introduced during software development
- strength
- primary
- rationale
- Graceful error handling, output filtering, and DEP/ASLR harden software so its inherent weaknesses cannot be weaponized.
- UC-SDLC-03 — Define and approve security requirements for applications mitigates Vulnerabilities introduced during software development
- strength
- related
- rationale
- Documented, approved security requirements (input handling, logging, data protection) reduce ambiguity-driven security defects.
- UC-VULN-03 — Remediate identified flaws within defined timeframes mitigates Vulnerabilities introduced during software development
- strength
- related
- rationale
- Flaw remediation corrects identified software vulnerabilities, including dev-introduced ones, once discovered.
- UC-SDLC-12 — Manage solution assets and retire unsupported components mitigates Vulnerabilities introduced during software development
- strength
- related
- rationale
- Retiring or upgrading unsupported components removes accumulated known exploitable vulnerabilities.
- UC-SDLC-10 — Oversee outsourced development and vet developers mitigates Vulnerabilities introduced during software development
- strength
- related
- rationale
- Reviewing outsourced deliverables against requirements and requiring security-testing evidence reduces vulnerabilities in third-party code.
- UC-SDLC-01 — Follow a secure development lifecycle with approval gates mitigates Vulnerabilities introduced during software development
- strength
- primary
- rationale
- Integrating defined security activities, secure-dev standards/tooling and testing across every lifecycle phase directly reduces vulnerabilities introduced during development.
- UC-SDLC-02 — Plan and resource development programs and projects mitigates Vulnerabilities introduced during software development
- strength
- related
- rationale
- Funding information-security requirements as a planning line item resources secure-dev work but is an enabler, not a first-order defense; the vulnerabilities are removed by UC-01/UC-04/UC-05.
- UC-SDLC-07 — Approve, test, and accept changes before production release mitigates Vulnerabilities introduced during software development
- strength
- related
- rationale
- Pre-release acceptance testing catches functional and security defects before production.
- UC-SDLC-06 — Maintain configuration control over systems and code mitigates Vulnerabilities introduced during software development
- strength
- related
- rationale
- Tracking and resolving security flaws in configuration items reduces residual exploitable defects.
- UC-VULN-04 — Test software security during development and acceptance mitigates Vulnerabilities introduced during software development
- strength
- primary
- rationale
- SAST/DAST and security acceptance criteria catch and remediate vulnerabilities introduced during development before release.
- UC-VULN-02 — Test security through independent penetration exercises mitigates Vulnerabilities introduced during software development
- strength
- related
- rationale
- Application penetration testing uncovers exploitable software vulnerabilities in built systems.