CVE-2023-2885

The control directly mandates integrity protection for transmitted information, addressing failures to enforce message integrity in transit.

Directly requires integrity protection (e.g., signatures/hashes) for data-in-transit, which prevents the described weakness while also addressing confidentiality/availability.

Requires secure information transfer procedures that can include integrity checks.

A.8.20 explicitly requires controls to safeguard the confidentiality and integrity of data passing over networks (item e, plus hardening, filtering, protocol disabling, and virtualized separation), which directly stops exploitation of in-transit message tampering for most transmission scenarios; the bounded remainder is non-network channels or cases where the endpoint itself fails to enforce integrity checks.

A.8.21 requires identifying/implementing network service security features (auth, encryption, connection controls) plus rules for authentication, authorization, monitoring and access means (e.g. VPN); this stops exploitation of in-transit tampering for the subset of cases relying on those network-level protections, but leaves a bounded remainder where message-level integrity (e.g. signatures, MACs) is still absent or insufficient.

A.8.24's rules on algorithm selection, key management, and protecting transmitted information (esp. guidance c) directly stop modification-in-transit by mandating integrity-providing cryptography; remainder is bounded to non-crypto integrity mechanisms (e.g. non-repudiation-only schemes or physical-layer protections)

Application security requirements can specify integrity protection for transmitted messages.