CVE-2023-36013

Controls whether organization resources are exposed to external system spheres by permitting or prohibiting their use.

The control ensures information is not released into a security sphere where the recipient lacks matching access authorizations.

The control ensures information resources are not exposed to the incorrect (public) sphere through review and authorization.

Protects against data mining that would expose resources to unauthorized spheres by enforcing detection and controls.

Restricts information flows to ensure resources are not exposed to incorrect or unauthorized spheres.

Enables users to notice when hard-coded credentials have been exploited for unauthorized access.

Security training explicitly warns against hard-coded credentials, lowering their use in systems.

Controlling internal connections prevents exposure of resources to unintended internal spheres.

PR.AA-01's credential/key-management processes can reduce the incentive to embed secrets but do not address or detect hard-coded values in source code, so the weakness remains fully possible.

Network segmentation and unauthorized-access protections reduce the chance of resources being reachable by the wrong sphere.

Education on secure configuration practices discourages technical staff from embedding or relying on hard-coded credentials in systems and applications.

Placing systems of differing trust levels into separate domains prevents resources from being placed in a sphere where they are reachable by unintended actors.

Secure key-generation, distribution and storage procedures reduce the likelihood that hard-coded or default cryptographic keys will be introduced or left unprotected.

Explicit prohibition of hard-coded passwords and unauthenticated external services stops credentials from being embedded directly in source code.

Contractual requirements for secure coding practices and evidence of testing make it less likely that hard-coded credentials will be introduced or remain undetected in delivered code.