## 3 Enhanced Clements-Hoffman Model for Databases
Therefore, it is advisable to consider threats and vulnerabilities as a whole. Therefore, it is advisable to consider threats and vulnerabilities in the complex. Only together, they can cause an unwanted incident that can harm the system (assets). Furthermore, in this case, it is necessary to correctly define threats, vulnerabilities and the relationship between them. In this regard, we will extend the above model with full overlap to a 6-tuple by including a set of vulnerabilities (weakness) of objects (\(\Gamma\)):  
\[S^{\prime}=\{O,T,\Gamma,W,V,B\} \tag{2}\]  
where the main components of tuple (2) basically correspond to the components of tuple (1). The distinctive features are shown below. After the corresponding clarification of the model, the set \(V\) will be the set of ordered triples \(v_{r}=(t_{i},\gamma_{\psi},o_{j})\), \(\psi=1\_\Psi\), where \(\gamma_{\psi}\in\Gamma\) is the vulnerability (its type) used by the threat \(t_{i}\in T\) aimed at violating the security of the object \(o_{j}\in O\). The set of barriers will be accordingly defined as: \(B=V\times W=T\times\Gamma\times O\times W=\left\{b_{l}=(t_{i},\gamma_{\psi},o_ {j},w_{k})\right.\), \(l=1\_L\). Furthermore, the condition for ensuring full security will take the following form: \(\forall(v_{r})\), \(\exists(b_{l}=(t_{i},\gamma_{\psi},o_{j},w_{k}))\in B\). This condition means that for each triple \((t_{i},\gamma_{\psi},o_{j})\) from the set \(V\), a barrier \(b_{l}\in B\) is created, which makes it impossible to implement an undesirable incident (implementation of the \(t_{i}\in T\) threat using vulnerability \(\gamma_{\psi}\in\Gamma\)) in relation to the protected object \(o_{j}\in O\). In order to have a clear idea of what types of vulnerabilities are most important for databases, the authors of the paper, based on the analysis of existing taxonomies of vulnerabilities, determined a list of the main common weaknesses. It was based on the specification from the Common Weakness Enumeration (CWE) more precisely the classification of the abstract representation of the Research Concepts CWE [59] used by academic researchers, vulnerability analysts, and assessment tool vendors. Taking into account, the specifics of the aspects under consideration, due to the characteristic features of security inherent for databases and DBMS, their list included the following are the main weaknesses of a sufficiently high level of abstraction:  
1. _Improper privilege management_: incorrect assignment of privileges, elevation (escalation) of privileges, performing operations with excessive privileges;
2. _Improper authorization_: incorrect assignment of permissions for a critical resource, missing authorization, incorrect authorization, exposure of sensitive information through metadata, exposure of sensitive information through data queries. The authorization check is not performed or incorrectly performed when an actor attempts to access a resource or perform an action;3. _Improper authentication_: weak password, outdated password, authentication bypass, incorrect implementation of the authentication algorithm, insufficient session expiration, use of a password hash instead of a password for authentication, etc. ;
4. _Uncontrolled resource consumption_: the allocation of a limited resource is not properly controlled, thereby enabling an actor to influence the amount of resources consumed, which ultimately leads to their depletion;
5. _Clertext storage of sensitive information_;
6. _Inadequate encryption strength_;
7. _Improper scrubbing of sensitive data from decommissioned device_: scrubbing may be missing, insufficient, or incorrect;
8. _Use of a broken or risky cryptographic algorithm_: use of a non-standard cryptographic primitive with no proven strength;
9. _Use of insufficiently random values_;
10. _Insufficient verification of data authenticity_: download of code without integrity check, improper validation of integrity check value, improper verification (no verification) of the cryptographic signature;
11.