CVE-2023-2788

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

Locks the device (typically after inactivity) until re-authentication, addressing insufficient session expiration by preventing indefinite access.

Automatically terminating sessions after a defined period directly enforces session expiration, preventing indefinite session lifetimes that attackers can exploit.

Reviews of access controls detect missing authorization checks on critical functions or resources.

Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.

Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.

Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.

Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.

Credential lifecycle management directly includes enforcing session expiration to prevent reuse.

Authentication mechanisms can incorporate session timeout checks but do not inherently address expiration policy.

Authorization policy enforcement and review covers terminating stale sessions to limit access scope.

Requiring formal authorization of every access request before rights are granted ensures that checks for required permissions are performed, preventing missing authorization checks from being introduced.

A.5.18's provisioning, review, revocation and activation steps (incl. owner approval, SoD, timely removal on role/termination change) directly stop exploitation of missing authorization checks by ensuring no actor receives or retains rights to resources they should not access; the bounded remainder is that it cannot stop missing-authorization defects inside the enforcement mechanism itself once rights have been granted (e.g. flawed code that ignores the rights table).

By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.