CVE-2023-26427

Documenting users and component locations facilitates correct permission assignments for critical resources.

Requiring equivalent controls prevents incorrect permission assignments on critical backup resources at the alternate site.

Protecting backup availability and integrity requires correct permission assignments on critical backup resources.

Security category directly informs the required permission settings for critical resources before authorization occurs.

Procedures support proper permission assignment for critical resources through documented controls.

Attribute management for resources provides a mechanism to assign and maintain correct permissions based on security labels.

Prevents overly permissive assignments to critical resources by limiting to task needs.

Training policy covers correct permission assignment, reducing the ability to exploit incorrect permission assignments for critical resources.

A.5.1 only requires the existence of an overarching policy and topic-specific policies (including on access control); it does not itself enforce, implement, or act on permissions and therefore cannot stop CWE-732 from being exploitable.

A.5.12 only defines and communicates a classification scheme (with owners accountable for applying it); it does not itself enforce, restrict or decide any permissions, so the CWE-732 permission flaw can still be present and exploitable.

A.5.15 directly requires determining access needs, defining and communicating an access control policy, implementing rules that map rights/restrictions to entities (including consistency with classification), and considering need-to-know, privileged restrictions, segregation, formal authorization, and dynamic factors — which squarely stops most incorrect permission assignments from being exploitable; the bounded remainder is misconfigurations that violate the policy itself.

A.5.18 directly governs the provisioning, review, adjustment and revocation of logical access rights (including for critical resources) according to business needs, policy, SoD and risk, which stops most unintended actors from reading/modifying via incorrect permissions; the bounded remainder is incorrect permission assignments that are not access-right decisions at all (e.g. filesystem umask, ACL syntax errors).

Documented responsibility for protecting assets encourages correct permission settings rather than leaving them at insecure defaults.

Monitoring supplier policy changes and conducting audits can reveal incorrect permission assignments on resources managed by the supplier, prompting corrective action before they are exploited.