A.8.26 Technological
Application security requirements
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (12)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- SA-4mostlyaligns with — Both controls require security requirements—including authentication, access segregation, input validation, encryption, and non-repudiation—to be explicitly defined and incorporated during system or application acquisition and development.
- SA-8mostlyaligns with — The ISO control’s enumerated security requirements map directly to the engineering principles that NIST expects organizations to apply when designing applications to enforce confidentiality, integrity, and resilience.
- AC-3partialaligns with — Defining segregation of access, authorization limits, and output controls within application requirements supports the access-enforcement mechanisms that AC-3 implements at runtime.
- AU-2partialaligns with — Mandating transaction logging and monitoring as part of application requirements contributes to the event-logging capability that AU-2 establishes for security-relevant activities.
- SA-17partialaligns with — Specifying application-level security requirements such as authentication, access controls, and non-repudiation contributes to the security and privacy architecture and design activities that SA-17 governs.
- SC-28partialaligns with — Including requirements for protecting data at rest in application security specifications supports the objective of SC-28 to safeguard information stored on systems.
- SC-8partialaligns with — Requiring encryption and integrity protection for data in transit within application specifications aligns with the transmission confidentiality and integrity protections mandated by SC-8.
Aligned NIST CSF 2.0 outcomes (12)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- ID.RA-05mostlyaligns with — The ISO control's risk-assessment-driven derivation of application security requirements directly supports the CSF outcome of using threat, vulnerability, and impact information to understand inherent risk and prioritize responses.
- PR.AA-05mostlyaligns with — Specifying segregation of duties, access levels, and authorization rules for application functions and data aligns with the CSF outcome of defining, managing, and enforcing access permissions and entitlements.
- PR.DS-01mostlyaligns with — Requirements for protecting data at rest, in transit, and in use, plus encryption and integrity controls, map to the CSF outcome of safeguarding the confidentiality, integrity, and availability of data-at-rest.
- PR.DS-02mostlyaligns with — Mandating secure encryption of communications and protection of data in transit directly addresses the CSF outcome of protecting the confidentiality, integrity, and availability of data-in-transit.
- GV.OC-03partialaligns with — Incorporating legal, statutory, regulatory, and privacy obligations into application security requirements aligns with the CSF outcome of understanding and addressing cybersecurity-related legal and contractual requirements.
- PR.IR-01partialaligns with — Resilience requirements against malicious attacks and unintentional disruptions support the CSF outcome of protecting networks and environments from unauthorized logical access and usage.
- PR.PS-01partialaligns with — Input validation, integrity checks, and automated approval controls constitute configuration and control practices that align with the CSF outcome of establishing and applying configuration management.
Related OWASP ASVS 5.0 requirements (15)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V14.1.1fullcovers — Requiring classification of information processed by the application and the associated protection levels satisfies the ASVS demand for documented identification and classification of all sensitive data into protection tiers.
- V2.1.1fullcovers — The ISO requirement to identify and document input validation rules and business-process expectations directly satisfies the ASVS mandate that application documentation define how data items are validated against expected schemas and business rules.
- V8.1.1fullcovers — Defining segregation-of-access and authorization rules for data and functions in the ISO control meets the ASVS requirement that authorization documentation explicitly state function-level and data-specific access restrictions based on consumer permissions.
- V11.1.1mostlyaligns with — Mandating secure encryption of communications and protection of data at rest, in transit, and in use aligns with the ASVS requirement for a documented cryptographic-key-management policy and lifecycle.
- V6.1.1mostlycovers — Specifying authentication-related trust levels and controls in the application security requirements fulfills the ASVS need for documented rate-limiting, anti-automation, and adaptive-response measures that protect authentication functions.
- V1.2.4partialaligns with — The explicit call for resilience against SQL injection through input validation and parameterized queries aligns with the ASVS requirement that database queries use parameterization or equivalent safe mechanisms.
- V16.1.1partialaligns with — Including transaction-logging, monitoring, and non-repudiation requirements in the security specification partially satisfies the ASVS need for an inventory documenting what security events are logged at each layer.
- V16.5.1partialaligns with — Requiring controlled error-message handling in the ISO control aligns with the ASVS mandate that generic messages be returned for unexpected or security-sensitive errors to avoid information leakage.
Related weaknesses / CWE (748)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
CWE-1004←P →PCWE-1007←P →PCWE-102←P →PCWE-1021←P →PCWE-1022←P →PCWE-1023←P →PCWE-1024←PCWE-1025←P →PCWE-1039←P →PCWE-1049←P →PCWE-1057→PCWE-1058←P →PCWE-1066←P →PCWE-1067←PCWE-1068→PCWE-1083←P →PCWE-1088←P →PCWE-1091←P →PCWE-1103←P →PCWE-111←P →PCWE-1118←PCWE-112←P →PCWE-113←P →PCWE-114←P →PCWE-115←P →PCWE-116←P →PCWE-1173←P →PCWE-1174←P →PCWE-118←P →PCWE-119←P →PCWE-12→PCWE-120←P →PCWE-1204→PCWE-121←P →PCWE-122←P →PCWE-123←P →PCWE-1236←P →PCWE-124←P →PCWE-1240←P →PCWE-125←P →PCWE-1250←P →PCWE-1254←P →PCWE-126←P →PCWE-127←P →PCWE-1270←P →PCWE-1275←P →PCWE-128←P →PCWE-1284←P →PCWE-1285←P →PCWE-1286←P →PCWE-1287←P →PCWE-1288←P →PCWE-1289←P →PCWE-129←P →PCWE-130←P →PCWE-131←P →PCWE-1320←P →PCWE-1321←P →PCWE-1333→PCWE-1335←P →PCWE-1336←P →PCWE-134←P →PCWE-135←P →PCWE-138←P →PCWE-1385←P →PCWE-1386←P →PCWE-1389←P →PCWE-140←P →PCWE-141←P →PCWE-142←P →PCWE-143←P →PCWE-144←P →PCWE-145←P →PCWE-146←P →PCWE-147←P →PCWE-148←P →PCWE-149←P →PCWE-150←P →PCWE-153←P →PCWE-154←P →PCWE-155←P →PCWE-156←P →PCWE-157←P →PCWE-158←P →PCWE-159←P →PCWE-160←P →PCWE-162←P →PCWE-164←P →PCWE-166←P →PCWE-167←P →PCWE-168←P →PCWE-170←P →PCWE-172←P →PCWE-173←P →PCWE-176←P →PCWE-177←P →PCWE-178←P →PCWE-179←P →PCWE-180←P →PCWE-182←P →PCWE-183←P →PCWE-184←P →PCWE-185←P →PCWE-186←P →PCWE-187←P →PCWE-188←P →PCWE-190←PCWE-191←P →PCWE-192←P →PCWE-193←P →PCWE-194←P →PCWE-195←P →PCWE-196←P →PCWE-197←PCWE-198←P →PCWE-20→PCWE-200→PCWE-201←P →PCWE-202←P →PCWE-204←P →PCWE-209→PCWE-210←P →PCWE-219←P →PCWE-22←P →PCWE-228←P →PCWE-229←P →PCWE-23←P →PCWE-230←P →PCWE-231←P →PCWE-232←P →PCWE-233←P →PCWE-234←P →PCWE-235←P →PCWE-236←P →PCWE-237←P →PCWE-239←P →PCWE-24←P →PCWE-240←P →PCWE-241←P →PCWE-248←P →PCWE-25←P →PCWE-252←P →PCWE-253←P →PCWE-26←P →PCWE-27←P →PCWE-28←P →PCWE-284→PCWE-287→PCWE-288→PCWE-29←P →PCWE-290←P →PCWE-293→PCWE-294→PCWE-297←P →PCWE-30←P →PCWE-301→PCWE-302←P →PCWE-303←P →PCWE-304→PCWE-31←P →PCWE-311→PCWE-315→PCWE-317→PCWE-32←P →PCWE-322→PCWE-328→PCWE-337→PCWE-338→PCWE-34←P →PCWE-342→PCWE-343→PCWE-344→PCWE-345→PCWE-346←P →PCWE-348←P →PCWE-349←P →PCWE-35←P →PCWE-350←P →PCWE-351←P →PCWE-353←P →PCWE-354←P →PCWE-356←P →PCWE-357←P →PCWE-358←P →PCWE-36←P →PCWE-362←P →PCWE-363←P →PCWE-366←P →PCWE-369←P →PCWE-37←P →PCWE-372←P →PCWE-374←P →PCWE-377←P →PCWE-378←P →PCWE-38←P →PCWE-384→PCWE-39←P →PCWE-391←P →PCWE-392←P →PCWE-394←P →PCWE-40←P →PCWE-400→PCWE-401←P →PCWE-409→PCWE-41←P →PCWE-412→PCWE-413←P →PCWE-415→PCWE-416←P →PCWE-42←P →PCWE-422←P →PCWE-425→PCWE-43←P →PCWE-430←P →PCWE-431←P →PCWE-433←P →PCWE-435←P →PCWE-436←P →PCWE-437←P →PCWE-44←P →PCWE-440←P →PCWE-441←P →PCWE-444←P →PCWE-446←P →PCWE-447←P →PCWE-448←P →PCWE-449←P →PCWE-450←P →PCWE-451←P →PCWE-454←P →PCWE-456←P →PCWE-457→PCWE-46←P →PCWE-460←P →PCWE-462←P →PCWE-466←P →PCWE-469←PCWE-470←P →PCWE-471→PCWE-472←P →PCWE-473←P →PCWE-475←P →PCWE-476←P →PCWE-488←P →PCWE-491←P →PCWE-495←P →PCWE-499←P →PCWE-5→PCWE-50←P →PCWE-501←P →PCWE-523→PCWE-525←P →PCWE-526←P →PCWE-532→PCWE-535→PCWE-539←P →PCWE-541→PCWE-544←P →PCWE-548←P →PCWE-550←P →PCWE-551←P →PCWE-556→PCWE-564←P →PCWE-565←P →PCWE-566←P →PCWE-567←P →PCWE-57→PCWE-573←P →PCWE-588←P →PCWE-59←P →PCWE-598←P →PCWE-599→PCWE-6→PCWE-600←P →PCWE-602←P →PCWE-603←P →PCWE-606←P →PCWE-610←P →PCWE-611←P →PCWE-614→PCWE-616←P →PCWE-617←P →PCWE-618←P →PCWE-621←P →PCWE-622←P →PCWE-623→PCWE-624←P →PCWE-625←P →PCWE-626←P →PCWE-627←P →PCWE-639→PCWE-640→PCWE-641←P →PCWE-642→PCWE-643←P →PCWE-644←P →PCWE-646←P →PCWE-647←P →PCWE-648←P →PCWE-649←P →PCWE-650←P →PCWE-652←P →PCWE-66←P →PCWE-667←P →PCWE-67→PCWE-674→PCWE-675←P →PCWE-680←P →PCWE-681←P →PCWE-682←P →PCWE-684←P →PCWE-686←P →PCWE-687←P →PCWE-690←P →PCWE-692→PCWE-695←P →PCWE-697←P →PCWE-698←P →PCWE-704←P →PCWE-706←P →PCWE-707←P →PCWE-73←P →PCWE-74←P →PCWE-749←P →PCWE-75←P →PCWE-754←P →PCWE-755←P →PCWE-756←P →PCWE-757→PCWE-759→PCWE-76←P →PCWE-760→PCWE-763←P →PCWE-767→PCWE-768←PCWE-77←P →PCWE-774←P →PCWE-776←P →PCWE-777→PCWE-780→PCWE-782→PCWE-784→PCWE-786←P →PCWE-787←P →PCWE-788←P →PCWE-789←P →PCWE-790←P →PCWE-791←P →PCWE-792←P →PCWE-794←P →PCWE-799←P →PCWE-80←P →PCWE-804←P →PCWE-805←P →PCWE-807←P →PCWE-81←P →PCWE-82←P →PCWE-820←P →PCWE-821←P →PCWE-822←P →PCWE-823←P →PCWE-824←PCWE-825→PCWE-826←P →PCWE-827←P →PCWE-83←P →PCWE-830←P →PCWE-834←P →PCWE-835→PCWE-837←P →PCWE-838←P →PCWE-839←P →PCWE-84←P →PCWE-841←P →PCWE-843←P →PCWE-85←P →PCWE-86←P →PCWE-87←P →PCWE-88←P →PCWE-90←P →PCWE-908←P →PCWE-909→PCWE-91←P →PCWE-910←P →PCWE-911←P →PCWE-912←P →PCWE-913←P →PCWE-914←P →PCWE-915←P →PCWE-917←P →PCWE-923→PCWE-924←P →PCWE-925←P →PCWE-926←P →PCWE-927←P →PCWE-93←P →PCWE-939←P →PCWE-940→PCWE-941→PCWE-942←P →PCWE-943←P →PCWE-95←P →PCWE-96←P →PCWE-97←P →PCWE-98←P →PCWE-99←P →P
Why these map — AI rationale (under review)
- CWE-1004partialprevents — Application security requirements can mandate HttpOnly on sensitive cookies.
- CWE-1007partialprevents — Application security requirements can mandate visual safeguards against homoglyph confusion.
- CWE-102partialprevents — Application security requirements can mandate unique validation-form names and validation coverage.
- CWE-1021partialprevents — Application security requirements can mandate frame-ancestors / X-Frame-Options, directly addressing UI redressing risks.
- CWE-1022partialprevents — Application security requirements can mandate explicit handling of external links and window.opener protections.
- CWE-1023partialprevents — Application security requirements can mandate complete multi-factor comparisons, but the control is broader than this single weakness.
- CWE-1025partialprevents — Application security requirements can specify correct comparison criteria and validation rules.
- CWE-1039partialprevents — Application security requirements can mandate detection and handling of adversarial perturbations in automated recognition systems.
- CWE-1049partialprevents — Application security requirements can mandate query-performance and data-volume constraints.
- CWE-1057partialprevents — Application security requirements can specify central data-manager usage, mitigating the weakness.
- CWE-1058partialprevents — Application security requirements can specify thread-safety and immutability rules that mitigate unsafe static state.
- CWE-1066partialprevents — Application security requirements include specifying correct serialization methods for data elements.
- CWE-1068partialprevents — Application security requirements can reference design, but do not themselves ensure implementation matches that design.
- CWE-1083partialprevents — Application security requirements can specify exclusive use of the designated data manager, reducing the likelihood of direct access code.
- CWE-1088partialprevents — Application security requirements typically mandate timeout settings for remote resource access.
- CWE-1091partialprevents — Application security requirements can explicitly require deterministic cleanup of objects and resources.
- CWE-1103partialprevents — Application security requirements can specify platform-independence or equivalent functionality across target platforms.
- CWE-111partialprevents — Application security requirements can specify safe JNI usage and validation of native libraries.
- CWE-112partialprevents — Application security requirements explicitly call for validation of external data formats including XML.
- CWE-113partialprevents — Application security requirements explicitly call for controls against injection flaws including HTTP header manipulation.
- CWE-114partialprevents — Application security requirements can mandate validation of external inputs and libraries.
- CWE-115partialprevents — Application security requirements explicitly call for robust input handling and sanitization to avoid misinterpretation.
- CWE-116partialprevents — Application security requirements include explicit rules for safe output handling and encoding.
- CWE-1173partialprevents — Application security requirements explicitly call for proper input validation mechanisms.
- CWE-1174partialprevents — Application security requirements explicitly call for model-level validation controls.
- CWE-118partialprevents — Application security requirements can mandate bounds checking and safe indexing practices.
- CWE-119partialprevents — Application security requirements can specify memory-safety rules, but do not prescribe implementation details.
- CWE-12partialprevents — Application security requirements can mandate custom error pages as a non-functional security control.
- CWE-120partialprevents — Application security requirements can specify input-size validation and safe buffer handling to mitigate classic buffer overflows.
- CWE-1204partialprevents — Application security requirements can specify cryptographic standards including IV uniqueness and unpredictability.
- CWE-121partialprevents — Application security requirements can specify buffer-size and input-validation rules.
- CWE-122partialprevents — Application security requirements can specify bounds-checking and safe memory APIs that mitigate heap overflows.
- CWE-123partialprevents — Application security requirements can mandate input validation and bounds checking that mitigate arbitrary write conditions.
- CWE-1236partialprevents — Application security requirements include rules for safe CSV generation and handling of untrusted data.
- CWE-124partialprevents — Application security requirements can specify buffer-size and pointer-safety rules.
- CWE-1240partialprevents — Application security requirements can specify approved cryptographic standards and disallow risky primitives.
- CWE-125partialprevents — Application security requirements include explicit bounds and memory-safety specifications that mitigate buffer over-reads.
- CWE-1250partialprevents — Application security requirements may specify consistency rules but do not guarantee their implementation.
- CWE-1254partialprevents — Application security requirements can explicitly call for constant-time string comparisons in authentication and cryptographic code.
- CWE-126partialprevents — Application security requirements can specify buffer-size and bounds-checking rules.
- CWE-127partialprevents — Application security requirements can specify safe buffer handling and bounds checking.
- CWE-1270partialprevents — Application security requirements explicitly call for correct token issuance and validation mechanisms.
- CWE-1275partialprevents — Application security requirements can mandate SameSite attributes on sensitive cookies.
- CWE-128partialprevents — Application security requirements can mandate integer overflow protection and safe arithmetic.
- CWE-1284partialprevents — Application security requirements explicitly call for validation of size/length inputs, mitigating CWE-1284.
- CWE-1285partialprevents — Application security requirements typically mandate bounds checking and validation of offsets/indices.
- CWE-1286partialprevents — Application security requirements explicitly call for validation of input syntax.
- CWE-1287partialprevents — Application security requirements explicitly include validation of input data types and formats.
- CWE-1288partialprevents — Application security requirements include validation of complex inputs and cross-field consistency.
- CWE-1289partialprevents — Application security requirements can mandate input validation rules that prevent unsafe equivalence checks.
- CWE-129partialprevents — Application security requirements include validation of untrusted input used for indexing or addressing memory structures.
- CWE-130partialprevents — Application security requirements include explicit rules for handling message lengths and data structures.
- CWE-131partialprevents — Application security requirements can specify buffer-size validation rules.
- CWE-1320partialprevents — Application security requirements can mandate protection of outbound alerts and signals.
- CWE-1321partialprevents — Application security requirements explicitly call for safeguards against unsafe object attribute manipulation.
- CWE-1333partialprevents — Application security requirements can specify input-validation rules that limit regex complexity.
- CWE-1335partialprevents — Application security requirements can mandate input validation and range checks that avoid invalid shift counts.
- CWE-1336partialprevents — Application security requirements explicitly call for neutralizing special elements in template engines.
- CWE-134partialprevents — Application security requirements can specify safe formatting functions and ban uncontrolled format strings.
- CWE-135partialprevents — Application security requirements can mandate proper handling of multi-byte character encodings to prevent length miscalculations.
- CWE-138partialprevents — Application security requirements explicitly call for controls against injection and malformed input that cause CWE-138.
- CWE-1385partialprevents — Application security requirements can mandate origin validation for WebSocket communications.
- CWE-1386partialprevents — Application security requirements can explicitly require protection against Windows reparse-point attacks.
- CWE-1389partialprevents — Application security requirements include explicit handling of numeric input formats and bases.
- CWE-140partialprevents — Application security requirements include input validation and output encoding that mitigate delimiter mishandling.
- CWE-141partialprevents — Application security requirements explicitly call for neutralizing special characters in inputs passed to downstream components.
- CWE-142partialprevents — Application security requirements include rules for safe handling of untrusted input to prevent injection-style flaws.
- CWE-143partialprevents — Application security requirements include explicit rules for neutralizing special characters such as record delimiters.
- CWE-144partialprevents — Application security requirements typically include rules for neutralizing special characters such as line delimiters.
- CWE-145partialprevents — Application security requirements include explicit rules for sanitizing inputs that could be interpreted as section delimiters.
- CWE-146partialprevents — Application security requirements explicitly call for controls against injection and delimiter-based attacks.
- CWE-147partialprevents — Application security requirements explicitly call for handling of special input elements to avoid injection or termination attacks.
- CWE-148partialprevents — Application security requirements can mandate proper validation of leading characters or sequences.
- CWE-149partialprevents — Application security requirements explicitly call for neutralization of special characters such as quotes.
- CWE-150partialprevents — Application security requirements explicitly call for controls against injection and malformed input sequences.
- CWE-153partialprevents — Application security requirements explicitly call for neutralizing special elements before downstream processing.
- CWE-154partialprevents — Application security requirements explicitly call for controls against injection-style weaknesses including improper delimiter handling.
- CWE-155partialprevents — Application security requirements include rules for neutralizing special characters before downstream processing.
- CWE-156partialprevents — Application security requirements typically mandate proper input validation and neutralization of special characters including whitespace.
- CWE-157partialprevents — Application security requirements include rules for proper handling of paired delimiters in input processing.
- CWE-158partialprevents — Application security requirements include explicit rules for neutralizing dangerous characters such as NUL.
- CWE-159partialprevents — Application security requirements explicitly call for controls against malformed or malicious input.
- CWE-160partialprevents — Application security requirements explicitly call for neutralizing special characters in input handling.
- CWE-162partialprevents — Application security requirements can mandate proper neutralization of trailing special elements in input processing.
- CWE-164partialprevents — Application security requirements explicitly call for controls against injection and malformed input that cause this weakness.
- CWE-166partialprevents — Application security requirements can mandate handling of missing delimiters or markers in input.
- CWE-167partialprevents — Application security requirements explicitly call for robust input validation against malformed or special-element data.
- CWE-168partialprevents — Application security requirements typically mandate robust input validation and sanitization.
- CWE-170partialprevents — Application security requirements can explicitly call for proper string termination and buffer handling.
- CWE-172partialprevents — Application security requirements can mandate proper encoding/decoding to prevent data corruption or injection.
- CWE-173partialprevents — Application security requirements can mandate canonicalization and encoding validation to prevent alternate-encoding bypasses.
- CWE-176partialprevents — Application security requirements include proper handling of character encodings and input sanitization.
- CWE-177partialprevents — Application security requirements explicitly call for input validation and canonicalization, directly preventing improper URL decoding.
- CWE-178partialprevents — Application security requirements must specify case handling for identifiers and paths.
- CWE-179partialprevents — Application security requirements include input validation rules that must be applied after protective transformations.
- CWE-180partialprevents — Application security requirements include proper input handling to prevent validation-before-canonicalization flaws.
- CWE-182partialprevents — Application security requirements include rules for safe data transformation and output encoding.
- CWE-183partialprevents — Application security requirements can mandate strict, minimal allow-lists and input validation rules that prevent overly permissive lists.
- CWE-184partialprevents — Application security requirements can mandate complete input validation rules, but the control itself does not prescribe how to build those rules.
- CWE-185partialprevents — Application security requirements can mandate correct regex design and testing.
- CWE-186partialprevents — Application security requirements explicitly call for correct validation rules, reducing the risk of overly restrictive regex.
- CWE-187partialprevents — Application security requirements can mandate full, exact comparisons for sensitive operations.
- CWE-188partialprevents — Application security requirements can mandate explicit data-structure and protocol-layout specifications.
- CWE-191partialprevents — Application security requirements include bounds checking and safe arithmetic to avoid underflow conditions.
- CWE-192partialprevents — Application security requirements can mandate safe integer handling and range checks.
- CWE-193partialprevents — Application security requirements can specify bounds-checking and input validation to prevent off-by-one errors.
- CWE-194partialprevents — Application security requirements can mandate safe type handling and input validation to avoid sign-extension bugs.
- CWE-195partialprevents — Application security requirements can specify safe integer handling and type-conversion rules.
- CWE-196partialprevents — Application security requirements can specify safe handling of numeric types and bounds checking.
- CWE-198partialprevents — Application security requirements include correct interpretation of external data formats and byte ordering.
- CWE-20partialprevents — Mandating input controls that include integrity checks and input validation ensures that untrusted data is examined before use, blocking the root cause of many injection and malformed-data weaknesses.
- CWE-200partialprevents — Requiring classification of information, privacy needs, and protection of confidential data leads to controls that limit unintended disclosure of sensitive information.
- CWE-201partialprevents — Application-security requirements can mandate filtering or omission of sensitive fields before transmission.
- CWE-202partialprevents — Application security requirements can mandate controls against inference in query interfaces.
- CWE-204partialprevents — Application security requirements typically mandate consistent, non-revealing error messages.
- CWE-209partialprevents — Application security requirements can specify safe error messaging.
- CWE-210partialprevents — Application security requirements can explicitly forbid inclusion of sensitive data in error messages.
- CWE-219partialmitigates — Application security requirements can mandate that sensitive files are not stored under the web root.
- CWE-22partialprevents — Application security requirements include rules for safe file handling and canonicalization.
- CWE-228partialprevents — Application security requirements include explicit rules for input validation and malformed-data handling.
- CWE-229partialprevents — Application security requirements explicitly call for validation of all input parameters and fields.
- CWE-23partialprevents — Application security requirements explicitly call for controls against path traversal and other injection flaws.
- CWE-230partialprevents — Application security requirements can mandate explicit handling of missing parameter values.
- CWE-231partialprevents — Application security requirements typically mandate strict input validation and parameter count checks.
- CWE-232partialprevents — Application security requirements include validation of all parameters and handling of unsupported values.
- CWE-233partialprevents — Application security requirements explicitly call for validation of inputs and parameters, mitigating missing or undefined arguments.
- CWE-234partialprevents — Application security requirements include explicit specification of function interfaces and mandatory parameter validation.
- CWE-235partialprevents — Application security requirements typically mandate strict parameter validation and rejection of unexpected inputs.
- CWE-236partialprevents — Application security requirements mandate complete parameter specifications and error handling for unsupported inputs.
- CWE-237partialprevents — Application security requirements typically mandate robust parsing and validation of structured data inputs.
- CWE-239partialprevents — Application security requirements can mandate handling of incomplete or malformed inputs, mitigating this weakness.
- CWE-24partialprevents — Application security requirements explicitly call for controls against path traversal in file-handling functions.
- CWE-240partialprevents — Application security requirements include rules for consistent data structures and message formats.
- CWE-241partialprevents — Application security requirements typically mandate strong input validation and type enforcement to prevent malformed data processing.
- CWE-248partialprevents — Application security requirements typically mandate robust error and exception handling.
- CWE-25partialprevents — Application security requirements explicitly call for controls against path traversal and directory escape attacks.
- CWE-252partialprevents — Application security requirements include input/output validation and error handling that covers return-value checks.
- CWE-253partialprevents — Application security requirements include robust error handling that mitigates incorrect return-value checks.
- CWE-26partialprevents — Application security requirements explicitly call for controls against path traversal and other injection flaws.
- CWE-27partialprevents — Application security requirements include explicit rules for safe file-path handling and canonicalization.
- CWE-28partialprevents — Application security requirements include explicit rules for safe file-path handling and directory confinement.
- CWE-284partialprevents — Specifying required segregation of access and levels of access to data and functions directly forces the definition of authorization rules that stop improper access control weaknesses from being introduced.
- CWE-287partialprevents — Defining the required level of trust in entity identity and the authentication mechanisms to achieve it ensures that authentication is explicitly addressed rather than omitted.
- CWE-288partialprevents — Application security requirements can specify authentication on all channels but do not enforce it at runtime.
- CWE-29partialprevents — Application security requirements can mandate input validation and path canonicalization to block traversal sequences.
- CWE-290partialprevents — Application security requirements can include anti-spoofing controls but are not limited to them.
- CWE-293partialprevents — Application security requirements would mandate proper authentication design, indirectly reducing this weakness.
- CWE-294partialprevents — Application security requirements can mandate replay-resistant authentication designs, but the control itself does not prescribe the technical measures.
- CWE-297partialprevents — Application security requirements include secure communication and certificate validation for external services.
- CWE-30partialprevents — Application security requirements explicitly call for controls against path traversal and directory-escape attacks.
- CWE-301partialprevents — Application security requirements can mandate secure authentication design, indirectly reducing reflection risk.
- CWE-302partialprevents — Application security requirements can mandate cryptographic or server-side checks for all authentication tokens.
- CWE-303partialprevents — Application security requirements can specify correct authentication algorithm use but do not guarantee correct implementation.
- CWE-304partialprevents — Application security requirements may specify complete auth flows, but the control itself is broader.
- CWE-31partialprevents — Application security requirements explicitly call for controls against path traversal and other injection flaws.
- CWE-311partialprevents — Explicitly calling for protection of data in transit and at rest, plus secure encryption of communications, drives the implementation of encryption that prevents clear-text exposure of sensitive information.
- CWE-315partialprevents — Defines application security requirements that should include cookie protection but does not explicitly address it.
- CWE-317partialprevents — Application security requirements may include masking rules, yet the control is wider than this CWE.
- CWE-32partialprevents — Application security requirements explicitly call for controls against path traversal and directory-escape attacks.
- CWE-322partialprevents — Application security requirements can mandate authenticated key exchange for any cryptographic operations.
- CWE-328partialprevents — Application security requirements can specify strong hashing, but the control is broader.
- CWE-337partialprevents — Application security requirements can specify cryptographic controls that mitigate predictable seeds.
- CWE-338partialprevents — Application security requirements can specify cryptographically strong random number generation.
- CWE-34partialprevents — Application security requirements explicitly call for controls against path traversal and other injection flaws.
- CWE-342partialprevents — Application security requirements can specify cryptographically secure random values.
- CWE-343partialprevents — Application security requirements include proper random-number generation for security functions.
- CWE-344partialprevents — Application security requirements can mandate configurable values, but the control itself does not enforce it.
- CWE-345partialprevents — Application security requirements can mandate data authenticity verification mechanisms.
- CWE-346partialprevents — Application security requirements explicitly call for origin validation of inputs and communications.
- CWE-348partialprevents — Application security requirements can mandate trusted data sources and input validation, directly addressing the weakness.
- CWE-349partialprevents — Application security requirements explicitly call for strict separation and validation of trusted versus untrusted data sources.
- CWE-35partialprevents — Application security requirements include rules for safe file-path construction and canonicalization.
- CWE-350partialprevents — Application security requirements can mandate authenticated host verification instead of reverse DNS.
- CWE-351partialprevents — Application security requirements can mandate explicit type handling and validation rules.
- CWE-353partialprevents — Application security requirements can specify integrity checks for data transmission.
- CWE-354partialprevents — Application security requirements include integrity checks on messages and data, mitigating improper validation.
- CWE-356partialprevents — Application security requirements include user warnings for dangerous operations.
- CWE-357partialprevents — Application security requirements include clear, effective user warnings for dangerous operations.
- CWE-358partialprevents — Application security requirements explicitly call for correct implementation of standardized security mechanisms.
- CWE-36partialprevents — Application security requirements typically mandate controls against path traversal in file-access functions.
- CWE-362partialprevents — Application security requirements can specify thread-safety and locking rules, but do not prescribe implementation details.
- CWE-363partialprevents — Application security requirements can mandate atomic file operations, yet the control is broader than this specific race condition.
- CWE-366partialprevents — Application security requirements can mandate thread-safety and locking controls.
- CWE-369partialprevents — Application security requirements can mandate checks for zero denominators and safe arithmetic handling.
- CWE-37partialprevents — Application security requirements can mandate input validation to block absolute path traversal.
- CWE-372partialprevents — Explicit application security requirements can mandate state-transition validation and error-state handling.
- CWE-374partialprevents — Application security requirements can explicitly require defensive copies or immutability when data crosses trust boundaries.
- CWE-377partialprevents — Application security requirements can specify secure temporary-file creation and access controls.
- CWE-378partialprevents — Application security requirements include secure creation and permissioning of temporary files.
- CWE-38partialprevents — Application security requirements explicitly call for validation of file-path inputs to block traversal attacks.
- CWE-384partialprevents — Application-security requirements can specify session handling, yet the weakness fix alone does not meet the broader requirement.
- CWE-39partialprevents — Application security requirements can mandate input validation to block drive-letter path traversal.
- CWE-391partialprevents — Application security requirements include explicit handling of error conditions.
- CWE-392partialprevents — Application security requirements typically mandate explicit error condition reporting to calling components.
- CWE-394partialprevents — Application security requirements include proper validation of function results and error conditions.
- CWE-40partialprevents — Application security requirements can mandate input validation to reject malicious UNC paths.
- CWE-400partialprevents — Requiring resilience against unintentional disruptions and specifying automated controls such as approval limits reduces the likelihood that resource-exhaustion conditions will be triggered or remain unchecked.
- CWE-401partialprevents — Application security requirements can specify explicit memory-release rules, partially mitigating the weakness.
- CWE-409partialprevents — Application security requirements can mandate limits on decompression size and ratio.
- CWE-41partialprevents — Application security requirements can mandate canonicalization and input validation to block path equivalence.
- CWE-412partialprevents — Application security requirements can mandate that locks remain within the intended control sphere.
- CWE-413partialprevents — Application security requirements can mandate exclusive-access controls and locking mechanisms.
- CWE-415partialprevents — Application security requirements can mandate memory-safety rules that reduce double-free risk.
- CWE-416partialprevents — Application security requirements can specify memory-management rules that mitigate use-after-free.
- CWE-42partialprevents — Application security requirements can mandate input validation to reject ambiguous path forms.
- CWE-422partialprevents — Application security requirements can specify authenticated IPC and message-source verification to block unauthorized Windows messages.
- CWE-425partialprevents — Application security requirements may specify authorization rules, but the control does not implement them.
- CWE-43partialprevents — Application security requirements include validation rules that can block ambiguous path inputs.
- CWE-430partialprevents — Application security requirements can mandate explicit handler-to-object mapping rules.
- CWE-431partialprevents — Application security requirements typically mandate complete handler coverage for expected and unexpected conditions.
- CWE-433partialprevents — Application security requirements include rules for web content delivery and server-side file handling.
- CWE-435partialprevents — Explicit application security requirements can specify expected component interactions.
- CWE-436partialprevents — Explicit application security requirements can mandate unambiguous protocol and data-format specifications that prevent divergent interpretations.
- CWE-437partialprevents — Application security requirements can specify the need for exhaustive endpoint feature, behavior, and state modeling.
- CWE-44partialprevents — Application security requirements can mandate path validation rules that block internal-dot traversal.
- CWE-440partialprevents — Application security requirements explicitly define expected behavior that must be met.
- CWE-441partialprevents — Application-security requirements can mandate explicit source-identity preservation and authorization checks on forwarded requests.
- CWE-444partialprevents — Application security requirements can mandate strict HTTP message validation and canonicalization.
- CWE-446partialprevents — Application security requirements should specify correct UI behavior for security controls, reducing the chance of misleading user feedback.
- CWE-447partialprevents — Application security requirements should specify that advertised security functions must be fully implemented.
- CWE-448partialprevents — Application security requirements can mandate warnings or removal of deprecated UI functions.
- CWE-449partialprevents — Application security requirements explicitly capture correct user-action mapping and expected behavior.
- CWE-450partialprevents — Application security requirements can mandate clear, secure interpretation of user input and explicit user confirmation when needed.
- CWE-451partialprevents — Application security requirements can mandate proper display and validation of critical information in the UI.
- CWE-454partialprevents — Application security requirements explicitly require protection against untrusted initialization of critical internal state.
- CWE-456partialprevents — Application security requirements can explicitly require variable initialization to avoid undefined behavior.
- CWE-457partialprevents — Application security requirements can specify initialization rules, but the control itself does not directly address the weakness.
- CWE-46partialprevents — Application security requirements can mandate input validation for path names, reducing trailing-space equivalence issues.
- CWE-460partialprevents — Application security requirements can specify robust exception handling and resource-release rules.
- CWE-462partialprevents — Application security requirements can mandate unique-key constraints and data-integrity rules.
- CWE-466partialprevents — Application security requirements can mandate pointer safety and range validation to avoid returning invalid addresses.
- CWE-470partialprevents — Application security requirements can explicitly prohibit or constrain reflection based on untrusted input.
- CWE-471partialprevents — Application security requirements can mandate integrity protections for data declared immutable.
- CWE-472partialprevents — Application security requirements explicitly call for validation of all inputs, including hidden fields, mitigating CWE-472.
- CWE-473partialprevents — Application security requirements explicitly call for protection against tainted input sources such as query parameters and cookies.
- CWE-475partialprevents — Application security requirements can mandate explicit input validation and defined behavior for API parameters.
- CWE-476partialprevents — Application security requirements can specify input validation and pointer-safety rules.
- CWE-488partialprevents — Application security requirements explicitly call for proper session isolation and state management.
- CWE-491partialprevents — Application security requirements can mandate defensive coding rules that prevent unsafe cloning.
- CWE-495partialprevents — Application security requirements can explicitly require defensive-copy or immutable return objects to avoid exposing internal state.
- CWE-499partialprevents — Application security requirements can specify that classes holding sensitive data must not be serializable.
- CWE-5partialprevents — Application security requirements may specify encryption for data in transit as a functional requirement.
- CWE-50partialprevents — Application security requirements include rules for safe path handling and canonicalization.
- CWE-501partialprevents — Application security requirements include explicit trust-boundary definitions and data classification at interfaces.
- CWE-523partialprevents — Specifies application security requirements that can include secure credential transmission.
- CWE-525partialprevents — Application security requirements can explicitly require no-cache headers or cache-control directives for sensitive pages.
- CWE-526partialprevents — Application security requirements can mandate that sensitive data not be stored unencrypted in environment variables.
- CWE-532partialprevents — Requiring restrictions on free-text fields and proper error-message handling stops developers from embedding or leaking sensitive data into logs or diagnostic output.
- CWE-535partialprevents — Application security requirements can mandate safe error handling but do not directly address this weakness.
- CWE-539partialprevents — Application security requirements can explicitly prohibit sensitive data in persistent cookies.
- CWE-541partialprevents — Application security requirements can mandate exclusion of secrets from include files.
- CWE-544partialprevents — Application security requirements can mandate standardized error handling as a non-functional requirement.
- CWE-548partialprevents — Application security requirements can mandate disabling directory indexing and enforcing proper access controls on web directories.
- CWE-550partialprevents — Application security requirements can specify safe error handling and generic messages.
- CWE-551partialprevents — Application security requirements should mandate correct authorization order after canonicalization.
- CWE-556partialmitigates — Application security requirements can mandate that impersonation is disabled or tightly scoped.
- CWE-564partialprevents — Application security requirements include secure query construction and ORM parameter binding.
- CWE-565partialprevents — Application security requirements can mandate cookie validation, integrity protection, and server-side session handling.
- CWE-566partialprevents — Defining application security requirements includes mandatory server-side authorization and parameterized queries that block this weakness.
- CWE-567partialprevents — Application security requirements can mandate proper synchronization primitives for shared data.
- CWE-57partialprevents — Defines application security requirements that should mandate path-handling controls.
- CWE-573partialprevents — Application security requirements explicitly capture specification compliance obligations that callers must follow.
- CWE-588partialprevents — Application security requirements can specify safe type handling and pointer-use rules.
- CWE-59partialprevents — Application security requirements can explicitly require safe handling of symbolic links and path traversal.
- CWE-598partialprevents — Application security requirements should mandate avoiding sensitive data in query strings.
- CWE-599partialprevents — Application security requirements may specify certificate validation but do not mandate the specific OpenSSL API usage.
- CWE-6partialprevents — Application security requirements can specify minimum session-ID length as a functional control.
- CWE-600partialprevents — Application security requirements include explicit handling of runtime errors and sensitive information disclosure.
- CWE-602partialprevents — Application security requirements explicitly call for server-side enforcement of security mechanisms.
- CWE-603partialprevents — Defines application security requirements that include server-side authentication enforcement.
- CWE-606partialprevents — Application security requirements include input validation rules that mitigate excessive looping from untrusted data.
- CWE-610partialprevents — Application security requirements explicitly call for controls against externally supplied resource identifiers.
- CWE-611partialprevents — Application security requirements explicitly call for disabling external entity processing in XML parsers.
- CWE-614partialprevents — Application security requirements can include cookie security settings, but the control is broader and does not explicitly mandate the Secure attribute.
- CWE-616partialprevents — Application security requirements include secure file-upload mechanisms that eliminate reliance on the four legacy PHP variables.
- CWE-617partialprevents — Application security requirements can specify that assertions must not be reachable from attacker-controlled inputs.
- CWE-618partialprevents — Application security requirements explicitly call for restricting unsafe ActiveX methods and browser-zone violations.
- CWE-621partialprevents — Application security requirements include explicit checks on external input used for variable naming.
- CWE-622partialprevents — Application security requirements explicitly call for validation of all external inputs, including function-hook parameters.
- CWE-623partialprevents — Application security requirements can mandate safe scripting policies, but do not directly prevent the marking flaw.
- CWE-624partialprevents — Application security requirements can mandate safe regex handling and input sanitization.
- CWE-625partialprevents — Application security requirements mandate strict input validation rules that would catch overly permissive regex.
- CWE-626partialprevents — Application security requirements can mandate proper handling of special characters such as null bytes.
- CWE-627partialprevents — Application security requirements can specify restrictions on dynamic variable or function evaluation.
- CWE-639partialprevents — Application security requirements can mandate authorization controls, yet the control itself is a requirements statement rather than an implemented safeguard.
- CWE-640partialprevents — Application-security requirements can mandate secure recovery flows, but the control covers many other requirements.
- CWE-641partialprevents — Application security requirements include rules for handling untrusted input when constructing file or resource names.
- CWE-642partialprevents — Application security requirements can mandate that critical state not be stored in untrusted locations.
- CWE-643partialprevents — Application security requirements explicitly call for defenses against injection flaws including XPath injection.
- CWE-644partialprevents — Application security requirements explicitly call for neutralizing untrusted data in HTTP headers.
- CWE-646partialprevents — Application security requirements can mandate content inspection, but the control itself does not prescribe the technique.
- CWE-647partialprevents — Defining application security requirements that mandate canonical URL handling and authorization checks mitigates the weakness at design time.
- CWE-648partialprevents — Application security requirements can specify correct invocation of privileged APIs.
- CWE-649partialprevents — Application security requirements should mandate integrity verification for any security-relevant inputs that are encrypted or obfuscated.
- CWE-650partialprevents — Application security requirements can mandate proper HTTP method usage and state-changing operation restrictions.
- CWE-652partialprevents — Application security requirements explicitly call for defenses against injection flaws including XQuery.
- CWE-66partialprevents — Application security requirements can mandate proper handling of file paths and virtual resources to prevent unintended file operations.
- CWE-667partialprevents — Application security requirements can mandate proper lock acquisition/release patterns.
- CWE-67partialprevents — Application security requirements include validation of file/path inputs, mitigating device-name attacks.
- CWE-674partialprevents — Application security requirements can mandate recursion limits or stack-depth checks.
- CWE-675partialprevents — Application security requirements can mandate single-operation semantics for critical resources.
- CWE-680partialprevents — Application security requirements can specify safe integer handling and bounds checking.
- CWE-681partialprevents — Application security requirements can mandate safe numeric handling and range validation.
- CWE-682partialprevents — Application security requirements can explicitly call for numeric accuracy and bounds checking.
- CWE-684partialprevents — Explicit application security requirements and acceptance criteria help ensure the delivered software matches its intended specifications.
- CWE-686partialprevents — Application security requirements can mandate strong typing and interface contracts that prevent incorrect argument types.
- CWE-687partialprevents — Application security requirements can mandate input validation and argument checking.
- CWE-690partialprevents — Application security requirements include defensive coding rules that address missing NULL checks.
- CWE-692partialprevents — Application-security requirements can mandate proper output encoding, but the control itself does not prescribe the technique.
- CWE-695partialprevents — Application security requirements explicitly forbid disallowed low-level functionality.
- CWE-697partialprevents — Application security requirements can mandate correct comparison logic for security decisions.
- CWE-698partialprevents — Application security requirements can mandate safe redirect patterns and post-redirect termination.
- CWE-704partialprevents — Application security requirements can mandate strong typing and safe casting rules.
- CWE-706partialprevents — Application security requirements can mandate validation of all external references and names used at runtime.
- CWE-707partialprevents — Application security requirements explicitly call for data validation and sanitization controls addressing neutralization weaknesses.
- CWE-73partialprevents — Application security requirements explicitly call for controls against untrusted input influencing file operations.
- CWE-74partialprevents — Application security requirements explicitly call for controls against injection attacks in software design.
- CWE-749partialprevents — Application security requirements can mandate that dangerous methods are not exposed in interfaces.
- CWE-75partialprevents — Application security requirements explicitly call for controls against injection flaws including special-element handling.
- CWE-754partialprevents — Application security requirements explicitly call for handling of exceptional conditions and error paths.
- CWE-755partialprevents — Application security requirements explicitly include handling of error and exceptional conditions.
- CWE-756partialprevents — Application security requirements can mandate custom error pages to prevent information leakage.
- CWE-757partialprevents — Application security requirements can specify minimum cryptographic strength to avoid downgrades.
- CWE-759partialprevents — Application security requirements can mandate salted hashing but do not prescribe the technical detail.
- CWE-76partialprevents — Application security requirements include rules for handling special characters and equivalent encodings.
- CWE-760partialprevents — Application security requirements can specify cryptographic standards that prohibit predictable salts.
- CWE-763partialprevents — Application security requirements can specify correct use of release functions and pointer validation.
- CWE-767partialprevents — Application security requirements can specify that private variables must remain inaccessible.
- CWE-77partialprevents — Application security requirements explicitly call for controls against injection flaws including command injection.
- CWE-774partialprevents — Application security requirements can mandate throttling and descriptor limits.
- CWE-776partialprevents — Application security requirements can explicitly call for limits on XML entity recursion and DTD processing.
- CWE-777partialprevents — Application security requirements can mandate anchored regex but do not prescribe the technique.
- CWE-780partialprevents — Application security requirements can specify cryptographic standards including OAEP.
- CWE-782partialprevents — Application security requirements capture the need for proper IOCTL authorization.
- CWE-784partialprevents — Application security requirements can specify cookie validation but do not mandate implementation details.
- CWE-786partialprevents — Application security requirements can mandate bounds checking and pointer validation to prevent pre-buffer accesses.
- CWE-787partialprevents — Application security requirements can specify bounds-checking and safe memory handling.
- CWE-788partialprevents — Application security requirements can mandate bounds checking and safe memory APIs.
- CWE-789partialprevents — Application security requirements mandate bounds checking on size parameters to avoid excessive memory allocation.
- CWE-790partialprevents — Application security requirements explicitly call for input validation controls that mitigate improper special-element filtering.
- CWE-791partialprevents — Application security requirements explicitly call for input validation and sanitization that directly mitigates incomplete special-element filtering.
- CWE-792partialprevents — Application security requirements explicitly call for input validation rules that mitigate incomplete special-element filtering.
- CWE-794partialprevents — Application security requirements include explicit rules for handling and filtering special characters in data flows.
- CWE-799partialprevents — Application security requirements explicitly include controls on interaction frequency and throttling.
- CWE-80partialprevents — Application security requirements explicitly call for neutralization of script-related HTML tags.
- CWE-804partialprevents — Application security requirements mandate effective CAPTCHA challenges that cannot be easily bypassed by bots.
- CWE-805partialprevents — Application security requirements can specify buffer-size validation, but do not prescribe implementation details.
- CWE-807partialprevents — Application security requirements explicitly call for validation of inputs used in security decisions.
- CWE-81partialprevents — Application security requirements explicitly call for proper handling of untrusted input to avoid script injection in error responses.
- CWE-82partialprevents — Application security requirements can mandate input validation and output encoding that prevent script injection in IMG attributes.
- CWE-820partialprevents — Application security requirements can specify thread-safety and locking mechanisms.
- CWE-821partialprevents — Application security requirements can mandate proper locking and thread-safety controls.
- CWE-822partialprevents — Application security requirements can mandate validation of pointers obtained from untrusted sources.
- CWE-823partialprevents — Application security requirements include memory-safety rules that reduce pointer-offset errors.
- CWE-825partialprevents — Application security requirements may mandate safe memory handling, but eliminating this single weakness does not satisfy the broader requirement.
- CWE-826partialprevents — Application security requirements can mandate explicit resource-release rules, partially addressing the weakness.
- CWE-827partialprevents — Application security requirements include rules for safe XML processing and external entity handling.
- CWE-83partialprevents — Application security requirements explicitly call for controls against injection flaws including attribute-based script injection.
- CWE-830partialprevents — Application security requirements can mandate vetting of external web components, but do not guarantee technical enforcement.
- CWE-834partialprevents — Application security requirements include resource-consumption limits that prevent unbounded loops.
- CWE-835partialprevents — Application security requirements can specify loop-termination rules, indirectly reducing the weakness.
- CWE-837partialprevents — Application-security requirements can specify single-action enforcement, yet the control is wider in scope.
- CWE-838partialprevents — Application security requirements can specify correct output encoding, yet the control is broader than this single weakness.
- CWE-839partialprevents — Application security requirements include explicit validation rules for numeric ranges, directly addressing the missing minimum check.
- CWE-84partialprevents — Application security requirements explicitly call for input validation and output encoding that directly prevent URI-scheme injection.
- CWE-841partialprevents — Application security requirements include sequencing and state-transition rules for critical workflows.
- CWE-843partialprevents — Application security requirements can specify strong typing and interface contracts that reduce type confusion.
- CWE-85partialprevents — Application security requirements can mandate input validation, yet the control itself does not prescribe the specific doubled-character filter.
- CWE-86partialprevents — Application security requirements explicitly call for validation of all inputs including identifiers, mitigating this weakness.
- CWE-87partialprevents — Application security requirements explicitly call for neutralization of untrusted input to block XSS variants.
- CWE-88partialprevents — Application security requirements include explicit rules for safe command-line argument handling and escaping.
- CWE-90partialprevents — Application security requirements include explicit rules for safe construction of directory queries, mitigating LDAP injection.
- CWE-908partialprevents — Application security requirements can specify mandatory initialization of variables and resources before use.
- CWE-909partialprevents — Application security requirements can specify resource initialization checks.
- CWE-91partialprevents — Application security requirements explicitly call for defenses against injection flaws including XML.
- CWE-910partialprevents — Application security requirements can mandate proper file-descriptor lifecycle handling.
- CWE-911partialprevents — Application security requirements can mandate correct resource-lifetime management, indirectly addressing reference-count errors.
- CWE-912partialprevents — Application security requirements explicitly define expected functionality, making hidden features a violation.
- CWE-913partialprevents — Application security requirements explicitly address restrictions on dynamic code execution and resource access.
- CWE-914partialprevents — Application security requirements can mandate strict control over dynamically-identified variables.
- CWE-915partialprevents — Application security requirements include explicit rules for allowable object attributes and safe deserialization.
- CWE-917partialprevents — Application security requirements explicitly call for controls against injection flaws including EL injection.
- CWE-923partialprevents — Application security requirements may specify endpoint validation but do not implement it.
- CWE-924partialprevents — Application security requirements can specify integrity protection for transmitted messages.
- CWE-925partialprevents — Application security requirements can mandate intent verification for broadcast receivers.
- CWE-926partialprevents — Defining application security requirements includes specifying proper export restrictions and permission checks for components.
- CWE-927partialprevents — Application security requirements can mandate explicit intents or secure IPC for sensitive data.
- CWE-93partialprevents — Application security requirements include rules for neutralizing special characters such as CRLF in inputs.
- CWE-939partialprevents — Requires security requirements that define which callers are permitted to trigger custom URL handlers, mitigating the authorization gap.
- CWE-940partialprevents — Application security requirements may specify origin checks but do not mandate them.
- CWE-941partialprevents — Application security requirements may mandate destination validation, yet the control is high-level.
- CWE-942partialprevents — Application security requirements should specify secure CSP and cross-domain policy settings, directly addressing the weakness.
- CWE-943partialprevents — Application security requirements explicitly call for controls against injection and improper query construction.
- CWE-95partialprevents — Application security requirements include rules against dynamic code execution of untrusted input.
- CWE-96partialprevents — Application security requirements include rules for neutralizing untrusted input before it is stored in executable resources.
- CWE-97partialprevents — Application security requirements include rules for neutralizing server-side directives in user input.
- CWE-98partialprevents — Application security requirements explicitly call for controls against injection and unsafe file operations.
- CWE-99partialprevents — Application security requirements explicitly call for controls on external identifiers used to access resources.
- CWE-1024nonenone — Application security requirements can specify strong typing and static-analysis rules that prevent type-mismatch bugs.
- CWE-1067nonenone — Application security requirements can mandate indexed queries and performance SLAs.
- CWE-1118nonemitigates — Application security requirements include specifying error-handling mechanisms.
- CWE-190noneprevents — Application security requirements include bounds checking and safe arithmetic to avoid overflow conditions.
- CWE-197nonenone — Application security requirements can specify safe numeric handling and data-type constraints.
- CWE-296nonemitigates — Application security requirements include proper TLS/certificate handling.
- CWE-469nonenone — Application security requirements can specify safe memory-handling rules that prevent pointer-subtraction errors.
- CWE-768nonenone — Application security requirements can mandate safe evaluation order and side-effect-free conditions.
- CWE-824nonenone — Application security requirements can specify pointer initialization rules.
Mitigated MITRE ATT&CK techniques (8)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1190mostlyprevents — Specifying resilience requirements against injection and buffer-overflow attacks forces developers to implement input validation and secure coding practices that reduce the likelihood of successful exploitation of public-facing applications.
- T1059partialprevents — Requiring input validation, integrity checks, and restrictions on free-text fields limits an attacker’s ability to inject or execute arbitrary commands through application interfaces.
- T1552partialmitigates — Mandating protection of credentials and confidential data while processed, in transit, and at rest decreases the chance that credentials stored or transmitted insecurely can be harvested by an adversary.
- T1003nonemitigates — Specifying access-segregation and data-protection requirements reduces the likelihood that an attacker who compromises an application can reach credential stores or memory regions used for credential dumping.
- T1040nonemitigates — Requiring encryption of communications between all parties prevents passive network sniffing from yielding usable credentials or sensitive application data in transit.
- T1046nonemitigates — Requiring segregation of access and least-privilege controls limits the attacker’s ability to discover and interact with additional services or functions once initial access is obtained.
- T1078nonemitigates — Defining authentication strength and identity-trust levels for entities accessing the application reduces the effectiveness of using stolen or weak credentials to gain unauthorized access.
- T1566nonemitigates — Requiring non-repudiation, transaction logging, and dual-approval controls for transactional services increases the difficulty of using phishing-delivered credentials or malicious payloads to manipulate or initiate fraudulent transactions.
Prevented OWASP Web Top 10 (2025) risks (7)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A06mostlyprevents — Requiring security specialists to define controls for trust, privacy, logging, and error handling embeds secure design principles into the application from the outset rather than bolting them on later.
- A01partialprevents — Specifying segregation of access, authentication trust levels, and authorization rules during requirements gathering directly enforces least-privilege boundaries before code is written.
- A04partialmitigates — Explicit requirements for encryption of data in transit and at rest, plus cryptographic mechanisms for integrity and non-repudiation, eliminate the root causes of weak or missing cryptography.
- A05partialprevents — Mandating input validation, integrity checks, and resilience against SQL injection and buffer overflows at the requirements stage stops these flaws from being introduced in design or code.
- A07partialmitigates — Defining authentication trust levels and authorization processes for entities and transactions reduces the likelihood of flawed or missing authentication mechanisms.
- A08partialmitigates — Requiring integrity verification (hashing, signatures, CRC) and non-repudiation for exchanged data prevents undetected tampering or unauthorized modification of software or transaction content.
- A09partialmitigates — Specifying transaction logging, monitoring interfaces, and non-repudiation requirements ensures that security-relevant events are captured and can be alerted on.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.