CVE-2023-32446

Data action mapping can detect storage actions that leave sensitive information in cleartext.

Reduces cleartext storage of sensitive data when OPSEC identifies and mandates protection of key information artifacts.

Training on secure data handling discourages cleartext storage of sensitive information.

Procedures mandate excluding sensitive data from logs to prevent unauthorized exposure via audit records.

Identifies insertion of sensitive data into logs, allowing detection of unauthorized disclosure.

Cross-organizational coordination enables agreement on what data to include in audit logs, directly reducing insertion of sensitive information.

Configuration policies can mandate secure storage methods to avoid cleartext storage of sensitive information.

The process of identifying and eradicating spilled information applies directly to sensitive data inserted into log files.

Log generation configuration can and should exclude sensitive data, but the control statement focuses on availability rather than content filtering.

By defining what records must be kept, where, and for how long, the control discourages the inadvertent inclusion of sensitive information in logs or other externally accessible files that fall outside the formal record system.

Requiring non-standard deletion or physical destruction of media ensures that sensitive information is not left in cleartext on discarded or repurposed equipment.

Secure deletion of data before device transfer prevents residual sensitive information from remaining in cleartext on storage media that leave organizational control.

Secure deletion of obsolete or temporary copies prevents sensitive data from remaining in cleartext on disk after its intended lifetime.

Substituting real values with hashes or encrypted tokens before storage reduces the quantity of cleartext sensitive information that ends up persisted on disk.