CVE-2023-3950

Training on secure data handling discourages cleartext storage of sensitive information.

Data action mapping can detect storage actions that leave sensitive information in cleartext.

Configuration policies can mandate secure storage methods to avoid cleartext storage of sensitive information.

Policy requires protection measures such as encryption for sensitive data stored on media, preventing cleartext exposure.

Key-management policy requires protected storage of key material, preventing cleartext storage of sensitive cryptographic keys.

Requiring confidentiality protection for information at rest eliminates cleartext storage of sensitive data on persistent media.

Reduces cleartext storage of sensitive data when OPSEC identifies and mandates protection of key information artifacts.

Requiring non-standard deletion or physical destruction of media ensures that sensitive information is not left in cleartext on discarded or repurposed equipment.

Secure deletion of data before device transfer prevents residual sensitive information from remaining in cleartext on storage media that leave organizational control.

Secure deletion of obsolete or temporary copies prevents sensitive data from remaining in cleartext on disk after its intended lifetime.

Substituting real values with hashes or encrypted tokens before storage reduces the quantity of cleartext sensitive information that ends up persisted on disk.

When clear-text sensitive data is detected leaving controlled storage, the control can block the transfer, thereby limiting the exposure that would result from unencrypted storage on external media or cloud services.

By insisting that any retained test copies be stored securely and only for testing, the control reduces the likelihood that clear-text operational data will persist on disk or in backups.