CVE-2023-43635

Enforces approved cryptographic algorithms for each use case, blocking use of broken or risky algorithms.

Flaw remediation replaces broken or risky cryptographic algorithms once safer implementations are released by vendors.

Training instructs users on protecting credentials from disclosure or unauthorized access.

Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.

Contacts with security groups provide timely information on broken or risky cryptographic algorithms, reducing the likelihood of their selection and use.

Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.

Rules of behavior include credential protection and non-sharing requirements, reducing exposure of insufficiently protected credentials.

Ongoing education and sharing of recommended practices helps organizations identify and migrate away from broken or risky cryptographic algorithms.

Proper data-at-rest integrity protection requires strong cryptographic hashes, directly blocking weak-hash usage.

Data-in-transit integrity likewise depends on strong hashes, so the control prevents the weakness while the weakness only partially satisfies the outcome.

Secure-SDLC requirements explicitly forbid weak cryptographic algorithms, fully preventing CWE-328 while covering only one aspect of development practice.

A.5.10 only requires awareness, a topic-specific acceptable-use policy stating expected behaviours/monitoring, and procedures referencing other controls (e.g. access restrictions, marking, disposal); it performs none of the verb on CWE-522's insecure credential transmission/storage, which requires technical protections like encryption or secure channels that this governance clause does not supply.

A.5.17 mandates secure allocation, transmission, storage, hashing/encryption per 8.24, strong non-reusable passwords, immediate change of defaults/compromise, and no cleartext — directly stopping exploitation of insufficiently protected credentials with only a bounded remainder (e.g. non-password authenticators or post-storage exposure vectors outside its scope).

A.5.31 only requires identifying, reviewing and considering legal/regulatory/contractual requirements (including crypto restrictions); it does not itself stop use of a broken algorithm or block its exploitation

A.5.6 only promotes membership in groups to receive early warnings, advisories, and specialist advice about vulnerabilities (including risky crypto); it does not stop exploitation of an already-present broken algorithm, which requires other controls (e.g. A.8.24) to act.

A.6.2 sets contractual terms, NDAs, and communicates responsibilities to personnel; it has no technical effect on how credentials are protected in transmission or storage and cannot stop exploitation of CWE-522