CVE-2023-49343

Controls whether organization resources are exposed to external system spheres by permitting or prohibiting their use.

The control ensures information is not released into a security sphere where the recipient lacks matching access authorizations.

The control ensures information resources are not exposed to the incorrect (public) sphere through review and authorization.

Protects against data mining that would expose resources to unauthorized spheres by enforcing detection and controls.

Restricts information flows to ensure resources are not exposed to incorrect or unauthorized spheres.

Controlling internal connections prevents exposure of resources to unintended internal spheres.

Knowing exact processing and storage locations helps avoid exposure of resources to incorrect spheres.

The control prevents exposure of the media resource to the wrong security sphere.

Secure SDLC practices directly require cryptographically secure PRNG seeding, preventing predictable seeds while the control addresses many additional weaknesses.

A.8.24 requires proper use of cryptography (algorithms, key management, protection of information) but does not address or stop the use of a predictable PRNG seed; the weakness can still arise and be exploited in any cryptographic implementation that follows the clause.

A.8.25 requires a secure SDLC process with checkpoints, secure coding guidelines, testing and developer training; it does not itself stop a predictable PRNG seed from being written or from remaining exploitable at runtime.

A.8.26 only requires that security requirements (including those derived from risk assessment) be identified and specified when developing or acquiring applications; it does not itself mandate, enforce or implement any specific mechanism that stops a predictable PRNG seed from being exploitable.

Secure architecture principles include choosing cryptographically strong random number generation.