CWE-1378: Gaps in Obligations and Training Vulnerabilities in ICS
This CWE highlights weaknesses in the obligations and training areas within an organization's operational technology sector, leading to unpatched environments and increased vulnerability to exploitation.
Summary
The weaknesses in this particular area are connected to the category in the SEI ETF's report titled "Categories of Security Vulnerabilities in ICS," specifically the section on "Gaps in obligations and training." The report, which was released in March 2022, highlights that there is a lack of clear definition and communication of ownership and responsibility for identifying and mitigating vulnerabilities within an organization's operational technology (OT) sector. As a result, there are instances where environments remain unpatched, susceptible to exploitation, and have a wider range of potential attack points. It's worth noting that these weaknesses include recommendations from the report's "Nearest IT Neighbor" section, as well as suggestions from the CWE team. It is expected that these relationships will evolve in future versions of CWE.