CVE-2023-37492

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

Reviews of access controls detect missing authorization checks on critical functions or resources.

Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.

Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.

Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.

The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.

Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.

Mandates authorization checks before permitting access or data processing via external systems.

Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.

Enforcing policy-driven approval and role-change reviews stops incorrect or stale authorization decisions from remaining in effect after job changes or terminations.

Segregating the approval of access rights from their implementation provides an independent check that reduces the impact of missing authorization checks in the resulting system configuration.

By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.

Defining authorization responsibilities and reviewing risk-treatment progress throughout the project lifecycle catches missing authorization checks before the system is deployed.