CVE-2023-2335

Requiring confidentiality protection for information at rest eliminates cleartext storage of sensitive data on persistent media.

Training instructs users on protecting credentials from disclosure or unauthorized access.

Training on secure data handling discourages cleartext storage of sensitive information.

Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.

Data action mapping can detect storage actions that leave sensitive information in cleartext.

Configuration policies can mandate secure storage methods to avoid cleartext storage of sensitive information.

Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.

Policy requires protection measures such as encryption for sensitive data stored on media, preventing cleartext exposure.

Encryption and cryptographic controls for data-at-rest directly prevent cleartext storage of sensitive information.

A.5.10 only requires awareness, a topic-specific acceptable-use policy stating expected behaviours/monitoring, and procedures referencing other controls (e.g. access restrictions, marking, disposal); it performs none of the verb on CWE-522's insecure credential transmission/storage, which requires technical protections like encryption or secure channels that this governance clause does not supply.

A.5.17 mandates secure allocation, transmission, storage, hashing/encryption per 8.24, strong non-reusable passwords, immediate change of defaults/compromise, and no cleartext — directly stopping exploitation of insufficiently protected credentials with only a bounded remainder (e.g. non-password authenticators or post-storage exposure vectors outside its scope).