CVE-2023-23850

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

Tailoring explicitly overrides or scopes default permission assignments in the baseline to match the system's actual risk and operational needs.

Reviews of access controls detect missing authorization checks on critical functions or resources.

Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.

Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.

Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.

Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.

The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.

Lifecycle management can encompass permission settings, yet the control is too broad to specifically mitigate incorrect defaults.

Defining and enforcing least-privilege access permissions directly prevents overly permissive defaults at install time.

Hardened baselines and configuration management explicitly require correct default file permissions.

Secure SDLC practices include establishing secure defaults, but address only the development-phase portion of the weakness.

Requiring formal authorization of every access request before rights are granted ensures that checks for required permissions are performed, preventing missing authorization checks from being introduced.

A.5.18's provisioning, review, revocation and activation steps (incl. owner approval, SoD, timely removal on role/termination change) directly stop exploitation of missing authorization checks by ensuring no actor receives or retains rights to resources they should not access; the bounded remainder is that it cannot stop missing-authorization defects inside the enforcement mechanism itself once rights have been granted (e.g. flawed code that ignores the rights table).

By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.