Incorporating CWE into Security Requirements

MITRE’s Common Weakness Enumeration (CWE) is the industry’s formal list of common hardware weaknesses addressing the increasing vulnerabilities from today’s complex systems, controls and processes. The CWE list provides a solid framework for preventing security vulnerabilities by helping identify missing security requirements.

When conducting a hardware security review, security teams begin by threat modeling and pinpointing assets they need to protect. They then establish specific security requirements that will ensure a “secure by design” status.

CWEs can be utilized to ensure the derived security requirements cover all industry-established common weaknesses applicable to the threat model are addressed, as well as identifying any requirements that may have been overlooked. Reporting coverage against the CWE database provides a quantifiable metric to effectively communicate what has been verified.

With vulnerabilities continually rising, a measurable reduction in hardware security risk requires a robust technical solution with broad coverage that is designed to validate CWEs.