Faults vs weaknesses

Question

I am trying to make the link between faults and weaknesses (As defined by Common Weaknesses Enumeration).

The word "fault" is generally used in the reliability domain, to designate the cause of an error i.e., the cause of the deviation from a correct service delivered by a system to an incorrect service.

The word "weakness" is widely used in the cybersecurity community, however, its meaning is not always clear. From my readings, a weakness is defined as a mistake in software that, in proper conditions, could contribute to the introduction of vulnerabilities within that software. A vulnerability being the occurrence of a weakness in a system.

I am trying to put into relation these two concepts (faults and weaknesses), to create a relation between reliability and security. From my observations, it is fair to say that a weakness is caused by a fault. When you consider a weakness such as "incorrect privilege assignment", it is clear that this could happen only because of a bad development of your system, which can be classified as a development fault.

In my opinion, if a development fault is not a weakness (i.e., cannot lead to any vulnerability), it means that the part of your system where the fault resides is not useful, hence could be removed.

Are all development faults weaknesses? Else, do you have a concrete counterexample?

Answer 1

This is a difficult question because it is difficult to define a weakness exactly, since the definition involves a considerable amount of speculation: it's something that might lead to a vulnerability. There are a lot of bugs that can be considered weaknesses. CWE says that a weakness is (emphasis added):

a type of mistake that, in proper conditions, could contribute to the introduction of vulnerabilities within that product. This term applies to mistakes regardless of whether they occur in implementation, design, or other phases of a product lifecycle.

And if you take a look at the lists of weaknesses on CWE's website, you will see that it includes a lot of generic mistakes and bad practices. Even a program that works perfectly without any functional bugs might be full of weaknesses under the hood. For example, in the list of weaknesses I have found the following interesting entries:

• Use of deprecated of obsolete functions
• Use of redundant code
• Incomplete documentation
• Insufficient logging
• Logging of excessive data
• Empty code block
• Incorrect calculation

So it sounds like anything that is implemented in a less than ideal way is going to be a weakness after all. Is every bug a weakness then? The answer is probably yes, as long as it occurs in an application or in a context where security is important. A glitch in an offline single-player arcade game? Not a weakness in my opinion. Code smell in an e-commerce application? That's probably a weakness, also according to CWE.