CVE-2023-31273

Implements a reliable, tamperproof protection mechanism whose completeness can be assured.

Policy requires training on privilege management and least privilege, making it harder to exploit improper privilege management weaknesses.

The control mandates review of privilege assignments to ensure they are appropriate and minimal.

Reviewing changes for security impacts prevents introduction of improper privilege assignments or escalations.

Baseline tailoring enforces organization-specific privilege-management decisions rather than accepting generic high-water-mark settings.

The documented concept of operations forces organizations to specify how privileges will be assigned, used, and reviewed, directly limiting improper privilege management in day-to-day operations.

Centralized privilege assignment and oversight prevent ad-hoc or excessive privilege grants that occur when each system is configured independently.

Dedicated senior leadership with resources directly enables consistent organization-wide privilege management and enforcement of least privilege.

A.5.15 directly mandates determining access requirements, defining/enforcing topic-specific access control policy, assigning rights/restrictions by entity/role, consistency with classification, need-to-know, privileged access restrictions, segregation, formal authorization, and dynamic rules — which stops most improper privilege management from being exploitable; bounded remainder is flawed implementation of those rules (e.g. incorrect mapping or enforcement bugs).

A.5.18 directly governs the provisioning, review, modification and timely revocation of access rights (including for role changes, termination and privilege levels), which stops most improper privilege spheres from being exploitable even if the assignment flaw exists; the bounded remainder is flaws in the underlying enforcement mechanism itself (e.g. AC-3/A.8.3)

Defining and communicating authorization levels for each role limits the assignment of excessive or unnecessary privileges.

Systematic verification that security mechanisms operate according to defined standards reduces the likelihood that protection mechanisms are bypassed or disabled.

Logging every use of privileges and protecting those records makes it harder for an attacker who has obtained elevated rights to operate without leaving evidence.

A.8.2 directly controls the identification, allocation, review, expiry, temporary use, and separation of privileged rights per policy, which prevents most improper privilege management (CWE-269) by design; the bounded remainder is flawed tracking/checking logic inside the product's own enforcement code (the AC-3 slice of 269).