Add a description of how to calculate functional density of security violations

Added functional desinty calculation

Added functional desinty calculation of security violations by dividing by Automated Function Points.

Revise and expand the description of the measure calculation

expanded calculation description

expanded the calculation description by several paragraphs

Replace description of CWE-327 with KDM- & SPMS-based representation.

Replaced CWE- description

Replaced description of CWE-327 with KDM- & SPMS-based representation.

Replace description of CWE-798 with KDM- & SPMS-based representation.

Replaced CWE-798 description

Replaced description of CWE-798 with KDM- & SPMS-based representation.

Replace description of CWE-131 with KDM- & SPMS-based representation and change number to CWE-789 since it provides the more common and case for this violation.

Replaced CWE- description and changed number

Replaced description of CWE-131 with KDM- & SPMS-based representation and changed number to CWE-789 because it represents the more general case.

Replace description of CWE-772 with KDM- & SPMS-based representation.

Replaced CWE-772 description

Replaced description of CWE-772 with KDM- & SPMS-based representation.

Shorten the reference section to only those related to the text and removing those whose text was deleted in revisions.

Referenes shortened

Eliminated references not longer referenced in the text.

Replace SMM representation since the charts are hard to read and do not add useful information beyond the accompanying SMM code. Add a section indicating additional ways the Security measure can be weighted to derive new measures.

Replaced section 9

Replaced the SMM representation with a list of derived measures.

reorder sequence of CWEs to be in numerical order

reordered CWEs numerically

Reordered CWEs in the document to be in numerical order by CWE number

Add an Appendix describing CISQ

Added CISQ appendix

Added Appendix A: CISQ with a description of CISQ

Change section 8
Add section 9

add sections 8, 9

new sections 8 and 9 to be consistent with other CISQ measure specs

The new section 7 includes the KDM elements in order to eliminate sub-patterns,.

insert new section 7

Adds KDM elements to eliminate subpatterns

Replace description of CWE-834 with KDM- & SPMS-based representation and change number to CWE-835 for infinite loop conditions

Replace CWE-834 description and changed number to CWE-835

Replace description of CWE-835 with KDM- & SPMS-based representation and changed number to CWE-835 which is the more general case for infinite loop conditions.

Replace description of CWE-706 with KDM- & SPMS-based representation and change number to CWE-99 since it describes the more general and inclusive case of this violation.

Replaced CWE-706 description ande change number

Replaced description of CWE-706 with KDM- & SPMS-based representation and changed the number to CWE-99 since that provides the more common and inclusive case of this violation.

Replace description of CWE-681 with KDM- & SPMS-based representation.

Replaced CWE-681 description

Replaced description of CWE-681 with KDM- & SPMS-based representation.

Replace description of CWE-667 with KDM- & SPMS-based representation.

Replace CWE-667 description

Replace description of CWE-667 with KDM- & SPMS-based representation.

Replace description of CWE-834 with KDM- & SPMS-based representation. Change CWE number to 606 since this CWE provides a clearer description of the violation for an unchecked range of input to a loop.

Replaced CWE-834 description and changed number

Replaced description of CWE- with KDM- & SPMS-based representation and changed number to CWE-606

Replace description of CWE-672 with KDM- & SPMS-based representation.

Replaced CWE-672 description

Replaced description of CWE- 672with KDM- & SPMS-based representation.

Replace description of CWE-456 with KDM- & SPMS-based representation.

Replaced CWE-456 description

Replaced description of CWE-456 with KDM- & SPMS-based representation.

Replace description of CWE-78 with KDM- & SPMS-based representation.

Replace descirption of CWE-78

Replace description of CWE-78 with KDM- & SPMS-based representation.

Replace description of CWE-89 with KDM- & SPMS-based representation.

Replace CWE-89 description

Replace description of CWE-89 with KDM- & SPMS-based representation.

Add KDM and change IPMSS to SPMS.

Made changes to section 5

Added KDM to the list. Changed IPMSS to SPMS.

Replace CWE-22 description with KDM- & SPMS-based representation

Replaced description of CWE-22

Replaced description of CWE-22 with KDM- & SPMS-based represetation

Replace description of CWE-129 with KDM- & SPMS-based representation.

Replace CWE-129 description

Replace description of CWE-129 with KDM- & SPMS-based representation.

Replace description of CWE-119 with KDM- & SPMS-based representation and correct the number from 119 to 120.

Replace CWE-119 description and correct CWE number

Replace description of CWE-119 with KDM- & SPMS-based representation and renumbered to CWE-120

Replace description of CWE-134 with KDM- & SPMS-based representation.

Replace CWE-134 description

Replace description of CWE-134 with KDM- & SPMS-based representation.

Replace description of CWE-434 with KDM- & SPMS-based representation.

Replace CWE-434 description

Replaced description of CWE-434 with KDM- & SPMS-based representation.

Split CWE-754 and change the CISQ 10 part to CWE-397 which is much more descriptive of failing to throw generic exceptions. Replace the description with a KDM- and SPMS-based representation.

Chnange CWE-754 to CWE-397 and replace text

Changed the CWE number from 754 to 397. Replaced description with KDM- and SPMS-based representations.

Shift from CWE-754 to CWE-396 which is specific for missing generic exceptions. Replace description with KDM- and SPMS-based representation.

*Split CWE-754 and replace CISQ-11 with CWE 396 *

Changed CWE # to 396 and replaced description with KDM-and SPMS-based representations

Replace description of CWE-745 with KDM- & SPMS-based representation. Change the CWE # to 252 since this is the more standard and common version of failing to check for unusual or exceptional conditions and is better explained for automation.

Replace CWE-754 description and change number

Replace description of CWE-754 with KDM- & SPMS-based representation and change CWE number.

Add definitions for software security, violation, CWE, quality characteristic.

Added definitions

Found additional terms in the specification that needed definition and added these to section 4. E.g., CWE, violation, software security, etc.

Added a bullet on 'objective' as a criteria for conformance with a description of its attributes. Eliminated subsection numbers since there is now only one section. Took 'compliance' out of the title since this is now only about conformance.

Reworked section 2

Add bullet for 'objective' as a conformance criterion. Eliminate subsection numbers. Eliminate 'Compliance' from title.

Insert revised Table 1 with an additional column. The revised columns should be: Security Pattern, Consequence, Objective, and Measure Element.

Inserted revised table 1.

Revised table 1 to go from 3 to 4 columns and to provide better brief explanations of the measure element using KDM in SPMS patterns, and a consequence of the pattern. Relabeled the columns. Revised intro paragraph to be consistent with table 1

Add an introduction to section 7 to explain the representation meta-models used and how to read and interpret the patterns.

Insdert intro to section 7.

Introductory sub-section added (7.1) to describe KDM, SPMS, and how to read and interpret the security patterns. Included Table 2 showing KDM representations of elements composing the CWEs. Added 'category definition' section (7.2) since it is needed as part of an SPMS model.

Eliminate all sub-patterns as they are no longer needed.

Eliominate all sub-patterns

Delete all text related to sub-patterns as they are no longer needed with the addition of KDM elements.

Replace description of CWE-79 with KDM- & SPMS-based representation.

Replace CWE-79 description

Replaced description of CWE-79 with KDM- & SPMS-based representation.

Replace description of CWE-327 with KDM- & SPMS-based representation.

Replace CWE-327 description

Replace description of CWE-327 with KDM- & SPMS-based representation.

Shorten section 1.3 and focus it only on the process through which the measure was created.

Shortened section 1.3

Moved the structural description material to section 1.4 and shortened the section to focus only on the process through which CISQ created the measure.

Shorten section 1.2 to provide briefer overview of quality characteristic measurement that is focused on the type of measure proposed.

Shortened Section 1.2

Consolidated the overview material and eliminated unnecessary explanation

Insert new section 1.4 to contain all information about the structure of the measure. Renumber the CWE/SANS Top 25 Weaknesses section to become 1.5

Created new section 1.4

Inserted new section 1.4 to incorporate all structural information about the measure. Renumbered old section 1.4 CWE/SANS Top 25 Weaknesses to become section 1.5.

Eliminate non-normative references from this section

Eliminate section 3.2

removed non-normative references from section 3.

Shorten section to a single paragraph that is revised to cover only the purpose of the measure

Shortened and revised 1.1

First paragraph revised to focus only on the purpose of the measure. The remainder of the old section moved to revised section 1.4

Eliminate section 2.1 since it is extraneous material that does not discuss how to conform to this specification.

Eliominated section 2.1

Deleted section

Add a section 1.6 Using and Improving This Measure

Created new section 1.6

Added section 1.6 Using and Improving This Measure