CVE-2023-2002

Periodic review and update of procedures reduces incorrect authorization implementations over time.

Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.

Reviewing accounts for compliance, disabling/removing unneeded accounts, and aligning with termination processes prevents execution with unnecessary privileges.

Periodic review and documentation of connection needs reduces incorrect authorization.

The control requires correct implementation of authorization specifically tied to change operations.

Authorization reviews within the risk management program detect and prevent incorrect authorization logic or policy enforcement before systems receive approval to operate.

Insider threat program enforces least-privilege reviews and monitors privileged actions, directly reducing abuse of unnecessary rights.

Org-wide risk executive function provides accountability and oversight that directly reduces execution with unnecessary privileges through consistent identification and mitigation.

A.5.15's policy, requirements, and rules for determining/minimizing access rights (incl. privileged access restrictions, need-to-know, least-privilege-like mapping, and role-based consistency) directly stop most unnecessary-privilege execution by design; bounded remainder is runtime elevation or misconfigured enforcement that still requires other controls (e.g. 8.2, 8.3) to act.

Requiring explicit justification and time-limited grants discourages the routine allocation of unnecessary privileges that would otherwise allow execution with more rights than required.

Independent scrutiny can identify processes or services still running with unnecessary privileges and drive their reduction before an attacker can abuse them.