CVE-2023-34128

Training instructs users on protecting credentials from disclosure or unauthorized access.

Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.

Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.

Rules of behavior include credential protection and non-sharing requirements, reducing exposure of insufficiently protected credentials.

Terminating or revoking credentials stops use of insufficiently protected or lingering credentials post-termination.

Requiring confidentiality/integrity protection for stored credentials directly mitigates insufficiently protected credentials on disk or in configuration stores.

Credentials or keys delivered out-of-band are not exposed to interception or inadequate protection on the main transport.

Least-privilege file permissions can limit access to the config but do not address the stored secret itself.

Encrypting or restricting data-at-rest directly prevents readable passwords in config files.

Secure configuration baselines explicitly disallow plaintext secrets in files.

A.5.10 only requires awareness, a topic-specific acceptable-use policy stating expected behaviours/monitoring, and procedures referencing other controls (e.g. access restrictions, marking, disposal); it performs none of the verb on CWE-522's insecure credential transmission/storage, which requires technical protections like encryption or secure channels that this governance clause does not supply.

Directly requires secure generation, storage and handling of authentication secrets, preventing passwords in config files.

A.6.2 sets contractual terms, NDAs, and communicates responsibilities to personnel; it has no technical effect on how credentials are protected in transmission or storage and cannot stop exploitation of CWE-522

Regular reminders about password security and personal accountability make users less likely to store or transmit credentials in cleartext or other unprotected forms.

A.8.24's purpose, guidance (b,c), and key management mandate proper cryptography (algorithms, strength, protection of credentials in storage/transmission) per classification, which stops exploitation of insufficiently-protected credentials; remainder is bounded (e.g. non-cryptographic protections like hashing-only or non-crypto obfuscation per CWE-522 details).