CVE-2026-103256

Authenticator management requires secure generation, storage, and distribution of credentials, directly stopping insecure methods.

Protection of information at rest requires encryption or equivalent safeguards for stored credentials.

Transmission confidentiality and integrity enforcement stops credentials from being sent in plaintext or without protection.

Credential management practices directly reduce insecure storage/transmission but do not guarantee encryption or transport protection.

Authentication policies can enforce stronger credential handling yet address only verification, not storage or transit protection.

Protecting identity assertions covers conveyance of credentials but is narrower than full credential lifecycle protection.

Encrypting data-at-rest fully prevents insecure credential storage while only partially satisfying the broader data-protection outcome.

Encrypting data-in-transit fully prevents interception of credentials in motion while only partially satisfying the broader data-protection outcome.

A.5.10 only requires awareness, a topic-specific acceptable-use policy stating expected behaviours/monitoring, and procedures referencing other controls (e.g. access restrictions, marking, disposal); it performs none of the verb on CWE-522's insecure credential transmission/storage, which requires technical protections like encryption or secure channels that this governance clause does not supply.

A.5.17 mandates secure allocation, transmission, storage, hashing/encryption per 8.24, strong non-reusable passwords, immediate change of defaults/compromise, and no cleartext — directly stopping exploitation of insufficiently protected credentials with only a bounded remainder (e.g. non-password authenticators or post-storage exposure vectors outside its scope).

A.6.2 sets contractual terms, NDAs, and communicates responsibilities to personnel; it has no technical effect on how credentials are protected in transmission or storage and cannot stop exploitation of CWE-522

Regular reminders about password security and personal accountability make users less likely to store or transmit credentials in cleartext or other unprotected forms.

A.8.24's purpose, guidance (b,c), and key management mandate proper cryptography (algorithms, strength, protection of credentials in storage/transmission) per classification, which stops exploitation of insufficiently-protected credentials; remainder is bounded (e.g. non-cryptographic protections like hashing-only or non-crypto obfuscation per CWE-522 details).

A.8.5 mandates MFA, alternative strong methods, no cleartext transmission/storage of passwords, session termination, brute-force protection and secure log-on procedures that directly stop interception/retrieval of credentials even when they exist, leaving only a bounded remainder (e.g. non-password credentials or post-authentication storage outside log-on flows)