I just had a look at the current version, the 2024 edition, of the CWE Top 25 Most Dangerous Software Weaknesses. Based on the Common Weakness Enumeration weakness types, this list is updated regularly and reflects the most relevant weaknesses in software. Since 2019 this list is updated annually based on the recently observed vulnerabilities (documented as CVEs) and their mapping to weaknesses (CWE IDs) that resulted in these vulnerabilities.
The current version was published in mid-December 2024, and a look at the top weaknesses shows the same problems as every year. Back in pole position is CWE-79 (cross-site scripting), with CWE-787 (out-of-bounds write) in second place and CWE-89 (SQL injection) taking third place.
We can conclude that
Ok, that’s no surprise, but why is this the case? Are we still using so much legacy code, or is new software still developed, making the same mistakes as always? Don’t we have great programming languages and frameworks that will make it nearly impossible to run into these standard problems? Why are software developers not using these programming languages and frameworks? Probably, it’s a combination of both: A lot of software is still based on code developed 20 or more years ago, and switching to new programming languages and frameworks is not that easy.
Looking at the CWE Top 25 lists from the start in 2009 to the 2024 edition, we can certainly see that all the weaknesses can be broadly grouped into four categories:
Surely, software developers cannot learn about all the 900+ weakness types listed in the CWE database. But the good news is, they don’t need to. Focusing on the above-mentioned main categories and choosing programming languages and frameworks that help tackle these problems, can probably avoid 99 % of all weaknesses typically leading to the top vulnerabilities.
Maybe some nice AI tools can also help clean up the legacy code, which is still the foundation of many modern applications.
Something has to change if we don’t want to see the same CWE Top 25 entries for the next 15 years.
When you look at the privacy notices of some online services, you will probably get confronted with long, complicated texts that a normal person would simply scroll over and not read in full. Yet, these privacy notices provide the details on which personal data is used, for which purpose it is used, who is using it and who else gets access to the data, and what rights you (the data subject) have regarding your personal data. This information must be provided based on common data protection laws like GDPR. The GDPR, for example, requires that transparency on personal data processing be supplied in different scenarios (as defined in Articles 7, 13, and 14).
Using icons to depict what will happen to our personal data could replace long text descriptions. If those icons were well designed, standardized, and widely used, users could easily understand how their personal data would be used before using a web service or application. Wouldn’t that be great?
The GDPR explicitly states that standardized privacy icons could be used to ensure transparency in personal data processing. Article 12 (7) states:
The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing. Where the icons are presented electronically they shall be machine-readable.
Additionally, the GDPR also sets the basis for creating standardized icons in Article 12 (8), where it states:
The Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons.
Unfortunately, even many years after the GDPR has become effective, the European Commission has provided no privacy icons.
Currently, three initiatives worth mentioning are going in the direction intended by the GDPR.
A Swiss association comprised of attorneys and Swiss companies has created a set of icons and a guideline on how to use them. The icons can be used freely by anyone based on license terms and a required registration. The icons are created with the Swiss data protection law in mind and are available as webfonts and SVG files. All information is available in English, German, and Italian on the association’s website.
The data protection authority of the German state Baden-Württemberg had set up a contest in August 2021 to submit proposals for privacy icons by the end of September 2021. As a result of this contest, a set of privacy icons was selected, and they are now freely available. The icons are based on the GDPR but are missing two important aspects – the purpose of processing and the categories of personal data. The free download of PNG and SVG files is available on the website, which is only available in German.
Bitkom, Germany’s digital industry association, has set up a working group to develop icons and provide guidelines (only available in German) on how to use them. The icons cover the most relevant categories of personal data, processing locations, transfer types, and some processing purposes. Of all three icon initiatives, this set (in my opinion) goes best in the direction intended by the GDPR. The icons are free to use and are available for download as PNG and SVG files on the Bitkom website.
Interestingly, Bitkom’s privacy statement does not use these privacy icons, even though they have existed since 2023.
None of these currently available icons fit the need perfectly. Still, we should start using them until better icons become available. We definitely have to get rid of long and complicated privacy notices.
There have also been some research initiatives on what these icons should cover; however, they have not had any substantial results so far (as far as I am aware). Looking at the available icons, it would have been better to spend more time investigating which types of icons are needed.
Yet, the idea of having standardized privacy icons to make it easier for users to understand what will happen with their personal data before they start using a service or provide consent is great and should be pursued further! Ideally, this should happen with the adoption of the European Commission (possibly even the NIST or ISO) to make a standardized set of icons available.
Welcome to WordPress. This is your first post. Edit or delete it, then start writing!
