{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"cyber_security","domain":["Secure Development (SDLC) & Application Security","Vulnerability & Patch Management"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-event","iso-27005-threat"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Asdlc-vulnerabilities-in-software","description":"Inherent weaknesses in programming languages and development environments introduce errors and exploitable vulnerabilities into software products, and software malfunctions cause incorrect outputs, crashes, or security weaknesses.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"high","risk_id":"sdlc-vulnerabilities-in-software","taxonomies":["nist-800-30-threat-event","iso-27005-threat"],"treatment":"mitigate"},"id":"risk:sdlc-vulnerabilities-in-software","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Asdlc-vulnerabilities-in-software","sourceIds":["cobit-2019","iso-27001","nist-800-53","nist-ai-tevv-athlon","nist-csf-2","pci-dss","sox"],"sourceUrl":null,"title":"Vulnerabilities introduced during software development","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:08ccc3c6f566452a3185340998b0e69e262201186df25a9ccff0a34dcd89c76c","properties":{"rationale":"Enforced secure-coding standards plus code review and static analysis before release directly remove exploitable coding weaknesses.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-05-053afd62.json","sourceId":"uc:UC-SDLC-05","targetDetailPath":"/data/v1/records/risk-sdlc-vulnerabilities-in-software-10c28b16.json","targetId":"risk:sdlc-vulnerabilities-in-software","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0d1462e1671fa28bd0d094d2d78205e874eec72cae32b613c734c2181fd4b36f","properties":{"rationale":"Graceful error handling, output filtering, and DEP/ASLR harden software so its inherent weaknesses cannot be weaponized.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-07-abfa5ce7.json","sourceId":"uc:UC-VULN-07","targetDetailPath":"/data/v1/records/risk-sdlc-vulnerabilities-in-software-10c28b16.json","targetId":"risk:sdlc-vulnerabilities-in-software","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1032e81fcf49e40475e79b0fe57a2087db3da63eb097abf11b19ba2067454be9","properties":{"rationale":"Documented, approved security requirements (input handling, logging, data protection) reduce ambiguity-driven security defects.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","sourceId":"uc:UC-SDLC-03","targetDetailPath":"/data/v1/records/risk-sdlc-vulnerabilities-in-software-10c28b16.json","targetId":"risk:sdlc-vulnerabilities-in-software","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:389425c3f4a9e7ee08bec7c6ad3babae3d52ab6aebb3136e8d09f6c366d76336","properties":{"rationale":"Flaw remediation corrects identified software vulnerabilities, including dev-introduced ones, once discovered.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-03-cc58f6a7.json","sourceId":"uc:UC-VULN-03","targetDetailPath":"/data/v1/records/risk-sdlc-vulnerabilities-in-software-10c28b16.json","targetId":"risk:sdlc-vulnerabilities-in-software","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4410ab1f8381e575b2bd1b4621aca4346fcdd5a9dde590e56a3c41b7cd446ecd","properties":{"rationale":"Retiring or upgrading unsupported components removes accumulated known exploitable vulnerabilities.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-12-08ce2fc7.json","sourceId":"uc:UC-SDLC-12","targetDetailPath":"/data/v1/records/risk-sdlc-vulnerabilities-in-software-10c28b16.json","targetId":"risk:sdlc-vulnerabilities-in-software","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:517060641444e142182eed9cf5d405933cada7c0a48905fa9d26ccb9f81ec85c","properties":{"rationale":"Reviewing outsourced deliverables against requirements and requiring security-testing evidence reduces vulnerabilities in third-party code.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-10-3ac58852.json","sourceId":"uc:UC-SDLC-10","targetDetailPath":"/data/v1/records/risk-sdlc-vulnerabilities-in-software-10c28b16.json","targetId":"risk:sdlc-vulnerabilities-in-software","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:659cee6499f1e52f36c512c85e4ea53d38dcc186b9e90cc423bb48e9224d9529","properties":{"rationale":"Integrating defined security activities, secure-dev standards/tooling and testing across every lifecycle phase directly reduces vulnerabilities introduced during development.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-01-b3583fd1.json","sourceId":"uc:UC-SDLC-01","targetDetailPath":"/data/v1/records/risk-sdlc-vulnerabilities-in-software-10c28b16.json","targetId":"risk:sdlc-vulnerabilities-in-software","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:91a928fb016afb0672b207952fd2b093ec7f9725360dc4961db1ef8c0d76d8a3","properties":{"rationale":"Funding information-security requirements as a planning line item resources secure-dev work but is an enabler, not a first-order defense; the vulnerabilities are removed by UC-01/UC-04/UC-05.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-02-c3b003c2.json","sourceId":"uc:UC-SDLC-02","targetDetailPath":"/data/v1/records/risk-sdlc-vulnerabilities-in-software-10c28b16.json","targetId":"risk:sdlc-vulnerabilities-in-software","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:923389049fc97b8dff556664779a88dad851800b75a3c5ad33c406b921fa29a1","properties":{"rationale":"Pre-release acceptance testing catches functional and security defects before production.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-07-22470d8b.json","sourceId":"uc:UC-SDLC-07","targetDetailPath":"/data/v1/records/risk-sdlc-vulnerabilities-in-software-10c28b16.json","targetId":"risk:sdlc-vulnerabilities-in-software","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:92ceb1d076a8a9fa8ba8d3f2dc000a4e82d92e74330279209def97be89639b2a","properties":{"rationale":"Tracking and resolving security flaws in configuration items reduces residual exploitable defects.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-06-c1afc713.json","sourceId":"uc:UC-SDLC-06","targetDetailPath":"/data/v1/records/risk-sdlc-vulnerabilities-in-software-10c28b16.json","targetId":"risk:sdlc-vulnerabilities-in-software","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a98fca7383aa3850a59cb66b23b99e47621fe292b726a80ec24982fc1695b03d","properties":{"rationale":"SAST/DAST and security acceptance criteria catch and remediate vulnerabilities introduced during development before release.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-04-d07c87cf.json","sourceId":"uc:UC-VULN-04","targetDetailPath":"/data/v1/records/risk-sdlc-vulnerabilities-in-software-10c28b16.json","targetId":"risk:sdlc-vulnerabilities-in-software","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e8713eaa01ce3c2f5711b923ec55bf65142a4dd30de55b8fb9bd1c1cb99ac90a","properties":{"rationale":"Application penetration testing uncovers exploitable software vulnerabilities in built systems.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-02-8366666b.json","sourceId":"uc:UC-VULN-02","targetDetailPath":"/data/v1/records/risk-sdlc-vulnerabilities-in-software-10c28b16.json","targetId":"risk:sdlc-vulnerabilities-in-software","type":"mitigates"}],"schemaVersion":1}