Mirroring the MITRE Top 25 Most Dangerous Software Weaknesses: Implementing a Systematic Security Verification Strategy

Against the backdrop of the global wave of digitalisation, software security remains a major challenge for enterprises. Recently, MITRE released its 2024 Top 25 Software Weaknesses report, outlining a panoramic view of current software vulnerabilities based on an analysis of over 31,000 CVE records between June 2023 and June 2024. By deeply interpreting this report, we can not only clearly see the current security landscape but also gain insights into future development trends.

▌Key Findings: Risks and Opportunities in Software Security

New and Old Challenges in Web Security

Cross-Site Scripting (XSS, CWE-79) has returned to the top of the chart with a high score of 56.92, a phenomenon that invites deep reflection. In today's rapid iteration of Web technologies, why is this vulnerability type, which has existed for years, still so prevalent? This is closely related to the characteristics of current enterprise digital transformation.

As enterprise business continues to migrate to the cloud, the scale and complexity of Web applications are rapidly increasing. A large number of user interaction scenarios provide a broader attack surface for XSS. Particularly in sectors such as e-commerce and finance, complex front-end interactions and dynamic content rendering make input validation and output encoding extremely difficult. Even experienced development teams may overlook security details when handling complex business logic.

More notably, with the rise of low-code platforms, the barrier to application development has been significantly lowered. While this change improves development efficiency, it also introduces new security risks. Many developers using low-code platforms may not understand the attack principles and defence methods of XSS, leading to unintentionally introducing security vulnerabilities during the development process. This situation is particularly common in the development of internal corporate systems.

Memory Safety: Hidden Systemic Risks

Out-of-bounds Write (CWE-787) ranks second with a high score of 45.20, which is by no means accidental. Under the background of the rapid development of China's Industrial Internet, the impact of memory safety issues is constantly expanding. Especially in the process of digital transformation in the manufacturing industry, a large number of legacy industrial control systems are connected to modern network environments, and memory vulnerabilities in these systems could lead to severe security incidents.

Taking a large manufacturing enterprise as an example, when upgrading their intelligent manufacturing systems, they found that the control programs of multiple critical equipment had buffer overflow risks. These programs had been running stably for years, but in the process of integrating with the new system, the originally hidden memory safety issues gradually surfaced. Once exploited, it could not only stop the production line but also lead to equipment damage and personal safety hazards.

In the financial sector, memory safety issues likewise cannot be ignored. A bank discovered during a routine security check that a third-party component in its core transaction system contained a memory vulnerability. Attackers could potentially trigger an out-of-bounds write through a carefully crafted request, thereby tampering with transaction data. The characteristics of such vulnerabilities are high concealment and severe harm, which once exploited, could cause significant financial losses.

Evolutionary Trends of Emerging Vulnerabilities

This year's ranking changes reflect a profound shift in software security threats. The ranking of Code Injection (CWE-94) rose by 12 places, which is closely related to the evolution of enterprise technology architectures. Under a microservices architecture, dynamic configuration and hot updates have become standard features, but these convenient functions also provide new attack vectors for code injection.

An internet company introduced dynamic script execution capabilities to support rapid business iteration while upgrading its microservices framework. However, due to incomplete verification mechanisms, attackers could inject malicious code by modifying configuration parameters. This risk is particularly pronounced in cloud-native environments, as frequent interactions between services increase the attack surface, while containerised deployments make the scope of a vulnerability's impact harder to control.

The sharp rise in the ranking of Information Disclosure (CWE-200) reflects another reality: with the implementation of the Data Security Law and the Personal Information Protection Law, data security has become an important issue that enterprises cannot ignore. Especially in the current context of data-driven innovation, how to fully leverage data value while ensuring security and compliance has become a thorny problem.

Zero-day Vulnerabilities: Shorter Response Windows

Data shows that among the vulnerabilities exploited in 2023, the proportion of zero-day vulnerabilities has exceeded 50%, a figure that serves as a wake-up call. The time window from vulnerability disclosure to exploitation is shrinking dramatically, presenting a severe challenge to enterprise security response capabilities.

Traditional patch management processes often require multiple stages such as testing, approval, and batched deployment, with cycles that can last weeks or even longer. However, in the current threat environment, enterprises may only have a few days or even a few hours to respond to newly discovered vulnerabilities. This requires enterprises to establish a faster and more agile vulnerability response mechanism.

At the same time, supply chain complexity further exacerbates this issue. A seemingly insignificant component vulnerability can affect the entire business system through dependencies. An e-commerce platform was once forced to urgently upgrade its system during a shopping festival due to a vulnerability in an open-source logging component, putting immense pressure on operations.

▌Redefining Security Validation Strategies

Facing these challenges, we need to optimize our security validation strategies in the following aspects:

Building a Multi-dimensional Validation Scheme

Traditional security validation is often limited to a single dimension, such as the network layer or application layer. However, current high-risk vulnerabilities often involve multiple levels. For example, a seemingly simple XSS vulnerability may require simultaneous validation of the effectiveness of multiple protective links such as front-end filtering, server-side verification, WAF, or RASP rules.

In the practice of a financial institution, we implemented parallel validation across different network zones and security devices by deploying distributed validation nodes. This approach not only improves validation efficiency but, more importantly, can detect cross-level security issues that single-point validation might overlook.

Continuous Validation Mechanism

Security is not a static state, but a process that requires continuous validation and confirmation. Especially in modern IT environments where system configurations, business logic, and protection strategies are constantly changing, any change can affect the effectiveness of existing security measures.

We recommend that enterprises establish a "high-frequency, small-scope" validation model, rather than traditional "low-frequency, large-scope" scanning. By breaking down validation tasks into multiple small, highly targeted checklist items, issues can be detected timely without putting too much pressure on production systems.

Scenario-based Validation Mindset

When designing validation schemes, it is necessary to fully consider the enterprise's actual business scenarios. For instance, for the Resource Exhaustion software weakness (CWE-400) in the Top 25, traditional validation methods may be difficult to test fully in a production environment. In this case, it is necessary to design schemes that can effectively validate protection measures without affecting business operations.

An e-commerce platform innovatively adopted a small-scale validation method based on actual traffic characteristics to meet such challenges. Through analysing production traffic, they built validation use cases that conform to actual scenarios, which ensured the effectiveness of the validation while avoiding impacts on business operations.

Dynamic Protection Capability Validation

Faced with new threats such as zero-day vulnerabilities, merely validating protection measures for known vulnerabilities is insufficient. Enterprises also need to validate the dynamic protection capabilities of their security architecture. This includes:

• Validating the effectiveness of anomaly detection systems

• Assessing the dynamic adjustment capability of security strategies

• Testing the feasibility and effectiveness of emergency response mechanisms

For example, a government agency verified not only the effectiveness of specific protection measures but, more importantly, tested the collaborative response capability of the entire security system through regular red-blue team confrontation exercises.

Automation and Intelligence in Security Validation

As the complexity of enterprise IT environments continues to rise, manual validation can no longer meet demands. Automation and intelligence are becoming inevitable trends in the field of security validation. However, it should be noted that automation is not a simple piling up of tools, but rather building an intelligent validation platform that can achieve the following objectives:

• Adapt to environmental changes and dynamically adjust validation strategies

• Update validation content timely based on threat intelligence

• Intelligently analyse validation results and provide feasible optimization recommendations

▌Best Practices: Security Validation Strategy Framework

We need to build a more systematic and continuous validation strategy. Based on extensive practical experience, we propose the following in-depth validation strategy framework.

Layered Validation: Building a Complete Validation Chain

When designing validation schemes, it is necessary to establish a complete layered validation system. Taking the most common XSS vulnerability (CWE-79) in the Top 25 as an example, a complete validation chain should include: Part.1

Front-end Protection Validation

• Validate the actual protective effect of the Content Security Policy (CSP), rather than simply confirming its configuration

• Test whether the XSS protection functions of JavaScript frameworks are correctly enabled on all pages

• Validate the effectiveness of filtering rules for special components such as rich text editors

Part.2

Middle-layer Validation

• Perform fine-grained validation of WAF's XSS protection rules, including:

  • Conventional cross-site scripting attack payloads

  • Bypass techniques under specific business scenarios

  • Handling capabilities for various encoding methods

• Validate API gateway input validation rules

• Check the security header configuration of load balancers

Part.3

Server-side Validation

• Validate the processing logic of server-side filters

• Check the escape function of template engines

• Validate whether the log auditing mechanism can effectively record attack behaviours

This layered validation is not a simple vulnerability scanning, but aims to design specific validation use cases for each protection layer.

For example, when validating WAF's XSS protection capabilities, the following points need to be considered:

• Special character combinations based on business scenarios

• Handling of different encoding methods (URL encoding, Unicode encoding, etc.)

• Detection capability of nested attack payloads

• Processing logic for specific business parameters

Validation Implementation Methodology: Continuous, Scenario-based, and Correlated Validation

Part.1

Continuous Validation Mechanism

Continuous validation is not a simple periodic scan, but requires the construction of a refined validation system:

1. Validation Frequency Grading

• Core Protection Capabilities: Multiple validations per day

  • WAF key rules effectiveness

  • Access control strategy execution status

  • Status of critical security components

• Extended Protection Capabilities: Daily validation

  • Security configuration integrity

  • Patch deployment effectiveness

  • Log auditing function

• Comprehensive Protection Capabilities: Weekly validation

  • Cross-system collaborative protection

  • Security strategy consistency

  • Coverage of newly added protection measures

2. Validation Depth Grading

• Quick Validation: Validate basic protection functions

• Routine Validation: Check the integrity of protection rules

• In-depth Validation: Test complex attack scenarios

• Comprehensive Validation: Assess overall protection effectiveness

3. Event-driven Validation

• Effectiveness validation after configuration changes

• Protection validation after new vulnerability disclosures

• Hardening validation after security incidents

For example, when validating SQL Injection (CWE-89) protection, the following validation strategy can be adopted:

1. Quick Validation (Hourly)

• Check if critical SQL injection protection rules are in effect

• Validate whether pre-configured protection strategies are running normally

• Confirm whether the monitoring and alarm mechanisms are normal

2. Routine Validation (Daily)

• Validate the protective effect against various types of SQL injection attacks

• Check special syntax handling for different database types

• Validate the enforcement of parameterised queries

3. In-depth Validation (Weekly)

• Test complex SQL injection bypass techniques

• Validate injection protection for stored procedures

• Check the protection capability against second-order injections

Part.2

Scenario-based Validation Strategy

Scenario-based validation needs to stand from the perspective of an attacker and design validation schemes based on a complete attack chain. We have designed the following defense-in-depth validation system based on the attack chain:

Layer 1: External Network Penetration Defense Line Validation

Validation Goal: Validate the effectiveness of boundary protection

Key Focus: Actual protective effects of security devices such as NGFW, WAF, and IPS

Layer 2: Lateral Movement Defense Line Validation

Validation Goal: Validate the effectiveness of internal network security protection measures

Key Focus: Actual effects of measures such as network isolation and permission control

Layer 3: In-depth Breakthrough Defense Line Validation

Validation Goal: Validate the effectiveness of core asset protection

Key Focus: Actual effects of measures such as data security and behavior monitoring

Part.3

Composite Scenario Correlation Validation

Validation of a single vulnerability can no longer satisfy current security requirements. We need to design correlation validation for composite scenarios:

1. Vulnerability Chain Validation

Considering multiple vulnerabilities that might simultaneously exist in a business system, when designing validation schemes, it is necessary to:

• Identify possible combinations of vulnerabilities

• Validate the correlation between vulnerabilities

• Assess the possibility of combined exploitation

2. Protection Chain Validation

Validate the collaborative protective effect of multiple security components:

• Check the coordination between protective measures

• Validate the consistency of security strategies

• Assess overall protective effects

3. Emergency Response Validation

Combine vulnerability validation with emergency response:

• Validate vulnerability detection capabilities

• Assess the effectiveness of response measures

• Verify the effectiveness of remediation schemes

Part.4

Validation Effectiveness Measurement

Key Validation Metric System

1. Coverage Metrics

• Asset Coverage = Identified Assets / Actual Total Assets

• Protection Coverage = Protected Points / Points That Should Be Protected

• Validation Coverage = Validated Items / Items That Should Be Validated

2. Effectiveness Metrics

• Protection Effectiveness Rate = Successful Protections / Total Attacks

• Detection Accuracy Rate = Accurate Alarms / Total Alarms

• Response Timeliness Rate = Timely Disposals / Total Alarms

3. Compliance Metrics

• Configuration Compliance Rate = Compliant Configurations / Total Configurations

• Strategy Execution Rate = Executed Strategies / Total Strategies

• Baseline Conformity Rate = Meeting-standard Items / Total Baseline Items

Continuous Improvement Mechanism: Data Comparison

• Comparison with historical baseline data

• Comparison with industry best practices

• Comparison with compliance requirements

The specific implementation of the validation system should be adjusted according to the enterprise's actual situation, focusing on core scenarios that have a significant impact on the business. Through this in-depth, systematic validation strategy, enterprises can truly establish an effective security protection system and ensure its continuous and effective operation.

With the popularization of cloud-native technology and the widespread application of artificial intelligence, software security will face new challenges. The adoption of technologies such as container orchestration and service mesh has made application architectures more complex, and traditional security boundaries are gradually disappearing. Meanwhile, the popularization of artificial intelligence applications has introduced new security threats such as model security and data poisoning.

Under these circumstances, enterprises need to view security construction with a more open mindset. Security is no longer the responsibility of a single department or stage, but a systemic project that needs to run through the entire software lifecycle. Only by establishing a continuous and comprehensive security validation mechanism can enterprises embrace innovation while ensuring security during their digital transformation process.