CWE-655: Insufficient Psychological Acceptability

Description

The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.

Abstraction: ClassAn abstract weakness, independent of any specific language or technology.
Likelihood of exploit: Not rated by MITRE
Status: Draft

Common consequences

Access Control
Bypass Protection Mechanism
By bypassing the security mechanism, a user might leave the system in a less secure state than intended by the administrator, making it more susceptible to compromise.

Potential mitigations

Testing
Where possible, perform human factors and usability studies to identify where your product's security mechanisms are difficult to use, and why.
Architecture and Design
Make the security mechanism as seamless as possible, while also providing the user with sufficient details when a security decision produces unexpected results.

Related weaknesses

Parent weaknesses

CAPEC attack patterns that exploit it

CWE 4.20 links no CAPEC attack pattern to this weakness.

Potential mitigations

Testing

Where possible, perform human factors and usability studies to identify where your product's security mechanisms are difficult to use, and why.

Architecture and Design

Make the security mechanism as seamless as possible, while also providing the user with sufficient details when a security decision produces unexpected results.