名前: Insufficient Psychological Acceptability

The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.

一般情報

導入モード

Architecture and Design

適用可能なプラットフォーム

言語

クラス： Not Language-Specific (Undetermined)

一般的な結果

スコープ	影響	可能性
Access Control	Bypass Protection Mechanism 注記：By bypassing the security mechanism, a user might leave the system in a less secure state than intended by the administrator, making it more susceptible to compromise.

潜在的な緩和策

Phases : Testing
Where possible, perform human factors and usability studies to identify where your product's security mechanisms are difficult to use, and why.
Phases : Architecture and Design
Make the security mechanism as seamless as possible, while also providing the user with sufficient details when a security decision produces unexpected results.

脆弱性マッピングノート

理由 : This CWE entry is a Class, but it does not have Base-level children.
コメント : This entry is classified in a part of CWE's hierarchy that does not have sufficiently low-level coverage, which might reflect a lack of classification-oriented weakness research in the software security community. Conduct careful root cause analysis to determine the original mistake that led to this weakness. If closer analysis reveals that this weakness is appropriate, then this might be the best available CWE to use for mapping. If no other option is available, then it is acceptable to map to this CWE.

ノート

This weakness covers many security measures causing user inconvenience, requiring effort or causing frustration, that are disproportionate to the risks or value of the protected assets, or that are perceived to be ineffective.

参考文献

REF-196

The Protection of Information in Computer Systems
Jerome H. Saltzer, Michael D. Schroeder.
http://web.mit.edu/Saltzer/www/publications/protection/

REF-539

Psychological Acceptability
Sean Barnum, Michael Gegick.
https://web.archive.org/web/20221104163022/https://www.cisa.gov/uscert/bsi/articles/knowledge/principles/psychological-acceptability

REF-540

Usability of Security: A Case Study
J. D. Tygar, Alma Whitten.
http://reports-archive.adm.cs.cmu.edu/anon/1998/CMU-CS-98-155.pdf

REF-44

24 Deadly Sins of Software Security
Michael Howard, David LeBlanc, John Viega.

登録情報

名前	組織	日付	リリース日	Version
Pascal Meunier	Purdue University	2008-01-18 +00:00	2008-01-30 +00:00	Draft 8

変更履歴

名前	組織	日付	コメント
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Common_Consequences, Relationships, Other_Notes, Weakness_Ordinalities
CWE Content Team	MITRE	2009-01-12 +00:00	updated Description, Name
CWE Content Team	MITRE	2009-05-27 +00:00	updated Name
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated References, Relationships
CWE Content Team	MITRE	2012-10-30 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2014-06-23 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, Causal_Nature
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships, Time_of_Introduction
CWE Content Team	MITRE	2022-04-28 +00:00	updated Relationships
CWE Content Team	MITRE	2022-10-13 +00:00	updated References
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description, Maintenance_Notes, Taxonomy_Mappings
CWE Content Team	MITRE	2023-04-27 +00:00	updated References, Relationships, Time_of_Introduction, Type
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-04-03 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Maintenance_Notes

CWE-655 詳細

CWE-655