CVE-2023-3300

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

Reviews of access controls detect missing authorization checks on critical functions or resources.

Explicitly specifying privileges and group/role memberships for accounts reduces the risk of incorrect privilege assignments.

Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.

Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.

Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.

Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.

The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.

Directly enforces least-privilege policy definition, management, and review that prevents incorrect privilege assignments.

A.5.15 directly requires determining access needs, defining/enforcing topic-specific access control policy and rules (including need-to-know, privilege restrictions, segregation, formal authorization, role-based mapping, and consistency with classification), which stops most incorrect privilege assignments from being exploitable; the bounded remainder is incorrect assignments that arise from flawed implementation of those rules rather than from their absence.

A.5.18's provisioning, review, revocation and SoD rules (esp. a,b,c,f,i,j) directly stop most incorrect privilege assignments from being granted or persisting, with a bounded remainder in flawed implementation of the authorization step itself (see 5.9/5.15 dependency)

By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.