무기체계 소프트웨어 정적 시험 기준

1. 무기체계 소프트웨어 코딩 규칙 준수

무기체계 소프트웨어 신뢰성 시험평가

무기체계 소프트웨어 신뢰성 시험평가

2. 취약점 점검 : 소프트웨어 취약점 점검(CWE-658/659/660) 및 보안약점 점 검 목록

가. CWE-658/659/660은 C/C++/Java 언어로 SW를 개발할 때  SW 소스 코드에 발생 빈도가 높은 취약점 목
나. 보안약점 점검 목록

1. CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
2. CWE-59 Improper Link Resolution Before File Access ('Link Following')
3. CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
4. CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
5. CWE-99 Improper Control of Resource Identifiers ('Resource Injection')
6. CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer O
7. CWE-134 Use of Externally-Controlled Format String
8. CWE-190 Integer Overflow or Wraparound O 259 Use of Hard-coded Password
9. CWE-285 Improper Authorization 306 Missing Authentication for Critical Function
10. CWE-307 Improper Restriction of Excessive Authentication Attempts
11. CWE-312 Cleartext Storage of Sensitive Information
12. CWE-319 Cleartext Transmission of Sensitive Information
13. CWE-321 Use of Hard-coded Cryptographic Key
14. CWE-327 Use of a Broken or Risky Cryptographic Algorithm
15. CWE-330 Use of Insufficiently Random Values
16. CWE-494 Download of Code Without Integrity Check
17. CWE-521 Weak Password Requirements
18. CWE-615 Information Exposure Through Comments
19. CWE-732 Incorrect Permission Assignment for Critical Resource
20. CWE-759 Use of a One-Way Hash without a Salt
21. CWE-170 Improper Null Termination O
22. CWE-209 Generation of Error Message Containing Sensitive Information O
23. CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition O
24. CWE-369 Divide By Zero O
25. CWE-390 Detection of Error Condition Without Action O
26. CWE-400 Uncontrolled Resource Consumption O
27. CWE-404 Improper Resource Shutdown or Release O
28. CWE- 415 Double Free O
29. CWE-416 Use After Free O
30. CWE-457 Use of Uninitialized Variable O
31. CWE-467 Use of sizeof() on a Pointer Type O
32. CWE-469 Use of Pointer Subtraction to Determine Size O
33. CWE-476 NULL Pointer Dereference O
34. CWE-489 Active Debug Code O
35. CWE-495 Private Data Structure Returned From A Public Method O
36. CWE-496 Public Data Assigned to Private Array-Typed Field O
37. CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere O
38. CWE-562 Return of Stack Variable Address O
39. CWE-587 Assignment of a Fixed Address to a Pointer O
40. CWE-628 Function Call with Incorrectly Specified Arguments O
41. CWE-676 Use of Potentially Dangerous Function O
42. CWE-755 Improper Handling of Exceptional Conditions O

O 코딩규칙점검 및 취약점점검 항목과 중복되는 규칙으로 SW 신뢰성시험 수행 시 고려 적용

다. 소스코드 메트릭(Code Metrics) 점검

• 소스코드 메트릭 종류 및 제한값은 개발언어, 도메인 특성을 고려하여 선정
• 소스코드 메트릭 종류 및 제한값은 소프트웨어 신뢰성시험계획에 반영, 개발 과정에서 준수 여부를 점검.