Description

The software has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.

Modes of Introduction:

– Architecture and Design

Related Weaknesses

CWE-657
CWE-693

Consequences

Access Control: Bypass Protection Mechanism

By bypassing the security mechanism, a user might leave the system in a less secure state than intended by the administrator, making it more susceptible to compromise.

Potential Mitigations

Phase: Testing

Description: 

Where possible, perform human factors and usability studies to identify where your product’s security mechanisms are difficult to use, and why.

Phase: Architecture and Design

Description: 

Make the security mechanism as seamless as possible, while also providing the user with sufficient details when a security decision produces unexpected results.

CVE References