CWE-1375: Gaps in Details/Data Security Vulnerabilities in ICS
This CWE entry highlights gaps in details/data security vulnerabilities in Industrial Control Systems (ICS), referencing the SEI ETF report. It emphasizes the importance of documenting knowledge and training procedures.
Summary
The weaknesses identified in this category can be linked to the "Gaps in Details/Data" category found in the SEI ETF report on "Categories of Security Vulnerabilities in ICS" that was released in March 2022. It is observed that personnel operating highly complex systems often have extensive experience in managing specific facilities or plants. Their knowledge and expertise are typically transferred through verbal or hands-on training, but may not be fully documented in written practices and procedures. It should be noted that the recommendations mentioned in the report, such as those for the "Nearest IT Neighbor," as well as suggestions from the CWE team, are included within this category. However, it is important to acknowledge that these relationships may evolve in future versions of the CWE.