CVE-2023-21512

Policy addresses roles, responsibilities, and privilege management to prevent improper privilege assignments.

Implements core proper privilege management by restricting to only required rights.

Baseline configuration documents and controls privilege assignments, making improper privilege management harder to introduce or sustain.

Requiring the most restrictive settings instead of defaults prevents incorrect default permissions on resources.

Defines roles and responsibilities to ensure proper privilege management during configuration changes.

Designates roles and review processes for managing physical privileges and access rights.

Tailoring explicitly overrides or scopes default permission assignments in the baseline to match the system's actual risk and operational needs.

Centralized privilege assignment and oversight prevent ad-hoc or excessive privilege grants that occur when each system is configured independently.

Lifecycle management can encompass permission settings, yet the control is too broad to specifically mitigate incorrect defaults.

PR.AA-01 supplies credential/identity lifecycle support that can reduce some privilege-assignment errors but does not itself assign, modify, or check privileges, leaving most of CWE-269's risk unaddressed.

PR.PS-05 can partially limit exploitability of some privilege issues via execution restrictions, but does not address the core design/implementation flaws of CWE-269 at all.

Secure SDLC practices include establishing secure defaults, but address only the development-phase portion of the weakness.

Explicit restrictions on privileged access and segregation of duties limit the scope of privileges that can be assigned, reducing the chance that excessive or unnecessary privileges are granted to entities.

Defining and communicating authorization levels for each role limits the assignment of excessive or unnecessary privileges.