CVE-2023-4662

Policy addresses roles, responsibilities, and privilege management to prevent improper privilege assignments.

Access supervision ensures privileges are assigned and managed without improper escalation or retention.

Assigning group/role memberships and access authorizations (privileges) while reviewing accounts addresses improper privilege management.

Separation of duties prevents any single user from holding all privileges needed to complete a critical task, directly reducing execution with unnecessary privileges.

Directly prevents execution with more privileges than needed for assigned tasks.

Role-based training on least privilege principles reduces the chance personnel assign or retain unnecessary privileges.

Analysis of audit records can identify execution with unnecessary privileges through unusual activity patterns.

Terminating and reviewing connections manages privileges associated with internal interfaces.

A.5.15's policy, requirements, and rules for determining/minimizing access rights (incl. privileged access restrictions, need-to-know, least-privilege-like mapping, and role-based consistency) directly stop most unnecessary-privilege execution by design; bounded remainder is runtime elevation or misconfigured enforcement that still requires other controls (e.g. 8.2, 8.3) to act.

Requiring explicit justification and time-limited grants discourages the routine allocation of unnecessary privileges that would otherwise allow execution with more rights than required.

Defining and communicating authorization levels for each role limits the assignment of excessive or unnecessary privileges.