Dear all, dropping the mentioned part of the sentence is a very good idea.
Apart from that I am fine with all three definitions. Best wishes Andreas Dr. rer. nat. Andreas Schweiger, Dipl.-Inf. (Univ.) System Architect TOR Embedded RTS Development - TEYXI Airbus Defence and Space T +49 8459 81-67087 M +49 172 7159582 F +49 8459 81-78112 E andreas.schwei...@airbus.com<mailto:andreas.schwei...@airbus.com> Airbus Defence and Space GmbH Rechliner Straße 85077 Manching Germany www.airbusdefenceandspace.com<http://www.airbusdefenceandspace.com/> Airbus Defence and Space GmbH Chairman of the Supervisory Board: Dominik Asam Managing Directors: Dr. Michael Schoellhorn (Chairman), Dr. Lars Immisch Registered Office: Ottobrunn District Court of Munich HRB 107 648 UST. Ident. Nr./VAT reg. no. DE167015661 THIS DOCUMENT IS NOT SUBJECT TO EXPORT CONTROL. From: James Pangburn [mailto:jpangb...@cadence.com] Sent: Wednesday, July 13, 2022 10:49 PM To: Joe Baum <joe.b...@motorolasolutions.com>; Kurt Seifried <k...@seifried.org> Cc: SJ Jazz <sjoeja...@gmail.com>; Alec J Summers <asumm...@mitre.org>; CWE Research Discussion <cwe-research-list@mitre.org> Subject: RE: CWE/CAPEC Definitions I also vote to drop “in a range of …” Best regards, Jim Pangburn Director, IPG Operations From: Joe Baum <joe.b...@motorolasolutions.com<mailto:joe.b...@motorolasolutions.com>> Sent: Wednesday, July 13, 2022 1:21 PM To: Kurt Seifried <k...@seifried.org<mailto:k...@seifried.org>> Cc: SJ Jazz <sjoeja...@gmail.com<mailto:sjoeja...@gmail.com>>; Alec J Summers <asumm...@mitre.org<mailto:asumm...@mitre.org>>; CWE Research Discussion <cwe-research-list@mitre.org<mailto:cwe-research-list@mitre.org>> Subject: Re: CWE/CAPEC Definitions EXTERNAL MAIL Or for that matter non-vendors. Software composition, as an example, Open Source, etc. Best Regards, Joe Baum Director, Threat Management Group On Wed, Jul 13, 2022 at 3:18 PM Kurt Seifried <k...@seifried.org<mailto:k...@seifried.org>> wrote: Also, it excludes services. So yeah, I vote drop the " in a range of products made by different vendors" On Wed, Jul 13, 2022 at 2:12 PM SJ Jazz <sjoeja...@gmail.com<mailto:sjoeja...@gmail.com>> wrote: I still recommend deleting at the end of the definition of weakness "... in a range of products made by different vendors. It adds no value, and actually unintentionally limits applicability by implying weaknesses only apply to products made by vendors. Regards, Joe On Wed, Jul 13, 2022, 12:08 Alec J Summers <asumm...@mitre.org<mailto:asumm...@mitre.org>> wrote: Dear CWE Research Community, I hope this email finds you well. Over the past few months, the CWE/CAPEC User Experience Working Group has been working to modernize our programs through a variety of activities. One such activity is harmonizing the definitions on our sites for some of our key terminology including weakness, vulnerability, and attack pattern. As CWE and CAPEC were developed separately and on a different timeline, some of the terms are not defined similarly, and we want to address that. We are seeking feedback on our working definitions: Vulnerability A flaw in a software, firmware, hardware, or service component resulting from a weakness that can be exploited, causing a negative impact to the confidentiality, integrity, or availability of an impacted component or components (from CVE®) Weakness A type of flaw or defect inserted during a product lifecycle that, under the right conditions, could contribute to the introduction of vulnerabilities in a range of products made by different vendors Attack Pattern The common approach and attributes related to the exploitation of a weakness, usually in cyber-enabled capabilities Note: CVE’s definition for ‘vulnerability’ was agreed upon after significant community deliberation, and we are not looking to change it at this time. We are hoping to publish new, improved definitions on our websites at the end of the month. Please provide thoughts and comments by Tuesday, July 26. Cheers, Alec -- Alec J. Summers Center for Securing the Homeland (CSH) Cyber Security Engineer, Principal Group Lead, Cybersecurity Operations and Integration –––––––––––––––––––––––––––––––––––– MITRE - Solving Problems for a Safer World™ -- Kurt Seifried (He/Him) k...@seifried.org<mailto:k...@seifried.org> For more information on how and why we collect your personal information, please visit our Privacy Policy<https://urldefense.com/v3/__https:/www.motorolasolutions.com/en_us/about/privacy-policy.html?elqTrackId=8980d888905940e39a2613a7a3dcb0a7&elqaid=2786&elqat=2*privacystatement__;Iw!!EHscmS1ygiU1lA!HoAHMf_wuSq-0SkyyBWnWkRrlC1iilECJYPmmvLny6ZvzB7Ffrj5HuBJ3ORBz0l5JEIPajfx6HC5WZtdO0TO93z2Ww$>. The information in this e-mail is confidential. The contents may not be disclosed or used by anyone other than the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, please notify Airbus immediately and delete this e-mail. Airbus cannot accept any responsibility for the accuracy or completeness of this e-mail as it has been sent over public networks. If you have any concerns over the content of this message or its Accuracy or Integrity, please contact Airbus immediately. All outgoing e-mails from Airbus are checked using regularly updated virus scanning software but you should take whatever measures you deem to be appropriate to ensure that this message and any attachments are virus free.
