What is the relationship of SANS Institute to the CWE Top 25?
SANS is an active participant in the Department’s Software Assurance Forum (that is co-sponsored by DoD and NIST) and often engages with DHS and all other forum participants on related activities. SANS has been a contributor to the CWE through its development over the past few years. In addition, SANS agreed to leverage their “Top XXX” brand. SANS’s original Top 10/20 consensus effort and the concept behind it generated a desire by organizations to compare themselves against the list, which, in turn, motivated tool and service providers to offer reports about SANS’s Top 20 status. We would hope that it would have the same effect in the software security weakness measurement and reporting industry, which is much needed to help focus organizations on specific targeted efforts versus general broad brush and diffuse efforts in improving software assurance.
