Anticipated Failure Determination-based Weakness Analysis with Common Weakness Enumeration

This paper presents a method for systematically identifying cybersecurity weaknesses in work products during the product development phase to reduce risk. This method adopts the Anticipatory Failure Determination method as the basis. The identification procedure adopts Common Weakness Enumeration as the knowledge base for identifying candidates with weak structures in the design. The procedural nature of the proposed method and the shared knowledge base for identifying candidate weaknesses increase the non-individuality of the derived results and objective validity. A case study showed that the method can identify design weaknesses while satisfying these requirements.