CVE-2023-28973

Role-based training addresses authorization requirements and checks, lowering the risk of improper authorization.

Auditing session actions allows identification of improper authorization decisions and enforcement failures.

Audit analysis reports findings of improper authorization, reducing the impact of such weaknesses.

Documenting authorization requirements and responsibilities for each exchange ensures authorization decisions are explicitly defined and managed.

Reconstitution restores proper authorization policies and enforcement that may have been altered.

Supplies backup authorization methods to block unauthorized actions when the primary authorization process is unavailable or compromised.

Identity providers centralize and enforce authentication mechanisms, reducing improper authentication.

Mandates authorization for identifier assignment, reducing risks of improper authorization.

A.5.1 only requires the existence of an overarching policy and topic-specific policies (including on access control); it does not itself perform or enforce any authorization check, so the CWE-285 weakness can still be exploited.

Mapping access rights to information classification and business requirements forces correct enforcement of authorization decisions, blocking the incorrect authorization weakness at the policy and implementation stage.

Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.

A.5.17 directly mandates generation of non-guessable unique secrets, secure transmission, immediate change of defaults/temporary creds, strong password enforcement, no-reuse, and compromise response, which stops most improper-authentication exploits at source; the bounded remainder is non-password authentication methods and sufficiency-of-proof cases (e.g. IA-2/IA-5 enhancements) left to other controls.

Independent reviewers evaluate whether authorization logic matches policy, thereby reducing the window in which incorrect or missing authorization checks remain in production.

By requiring managers to verify that authorization decisions match policy and to remediate deviations, the control limits the persistence of incorrect or missing authorization checks.