Which category system is widely used as a baseline for weakness identification, mitigation, and prevention?

• A. Buffer Overflows
• B. Common Weakness Enumeration (CWE)
• C. National Vulnerability Database (NVD)
• D. Remediation

Answer: (B)

Understanding standardized weakness classifications helps teams communicate about flaws consistently and build prevention into the development process. Common Weakness Enumeration (CWE) is widely used as a baseline for weakness identification, mitigation, and prevention. It provides a community-driven taxonomy of common software weaknesses, allowing developers, testers, and security professionals to map flaws to specific categories and corresponding mitigations, measure risk, and align with secure coding guidelines. Managed by MITRE, CWE also interfaces with other resources like CVE and NVD, helping translate weaknesses into concrete protections and testing criteria. The other options refer to a concrete weakness type (buffer overflows), a vulnerability database (NVD), or an action (remediation) rather than a classification system.