CWE-693, Protection Mechanism Failure, is a pillar level weakness. The product does not use, or incorrectly uses, a protection mechanism that would give sufficient defense against directed attacks. MITRE lists it as not language specific, not technology specific, and also applicable to ICS and OT.
How it happens
MITRE separates three situations, and the split is useful as a review checklist.
Missing. The application defines no mechanism against a class of attack at all. There is no CSRF defense, no rate limit, no integrity check on updates.
Insufficient. A mechanism exists and covers the common cases but not everything it was meant to. An input filter that blocks the usual payloads yet misses variants is the textbook case.
Ignored. The mechanism exists and is used, but a developer did not apply it on one code path. Think of an authorization check on every endpoint except the one added last week.
The third kind is the most frustrating, because the team did the hard part and a gap remained.
What an attacker gains
MITRE records one consequence: bypassing the protection mechanism, with access control as the scope. What follows depends on what was guarded.
How to find it
The record lists no detection methods and no observed CVEs for this pillar, which reflects how broad it is. Useful approaches:
- Write down the attacks you claim to defend against, then trace each to the code that defends against it.
- For every defense, list the entry points it should cover and check each one.
- Prefer central enforcement, such as middleware or a gateway, so the default is protected and exceptions are visible.
- Test the negative: call the endpoint without the token, without the role, without the header.
How to fix it
The record carries no mitigation text. Based on the three categories:
- Missing: add the defense at the layer where it applies to everything.
- Insufficient: replace partial checks such as blocklists with checks that define what is allowed.
- Ignored: make the safe path the default, so protection does not rely on every developer remembering it.
In supply chain terms, a protection mechanism that is available but not applied is common. A dependency you scan in one project and skip in another is an ignored control. The free scan at gold.safeguard.sh/scan checks a dependency file in your browser, with no login and no upload of the file, if you want a quick look at a project you have not covered.
Quick check
What are the three kinds of protection mechanism failure?
Missing, where no mechanism exists; insufficient, where it does not cover everything intended; and ignored, where it exists but is not applied on some code path.
