CVE-2023-47166

Managing identities and credentials is a prerequisite for authentication but does not itself enforce it on critical functions.

Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.

Defining and enforcing authorizations assumes prior authentication and therefore only partially mitigates the absence of authentication.

Protecting networks from unauthorized access can be undermined by missing authentication but does not address the root authentication gap.

A.5.1 only requires the existence of an overarching policy and topic-specific policies (including on access control); it does not itself perform or enforce any authorization check, so the CWE-285 weakness can still be exploited.

Mapping access rights to information classification and business requirements forces correct enforcement of authorization decisions, blocking the incorrect authorization weakness at the policy and implementation stage.

Independent reviewers evaluate whether authorization logic matches policy, thereby reducing the window in which incorrect or missing authorization checks remain in production.