Access rights must not reference objects that no longer exist

Control Statement: Object access rights must not reference objects that are no longer present in the configuration.

Description: Object operation rights are stored against the identifier of the object they govern. Deleting an object does not necessarily remove the rights configured for it, leaving grants that refer to a subject no longer present in the configuration. This control requires that such orphaned entries be identified and removed.

Rationale: Orphaned rights are not directly exploitable, and this control is included for assurance rather than as a boundary. Their significance is what they indicate: a permission model that is added to but never reconciled. An access model carrying grants for objects that no longer exist is one where nobody has reviewed the whole picture recently, which materially weakens any assurance drawn from the controls that depend on that model being deliberate. Orphaned entries also inflate every subsequent review, since each reviewer must independently determine that the entries are inert.

Audit Procedure:

1. Export or enumerate the configured object operation permissions together with the object each entry refers to.
2. Resolve each referenced object against the objects currently present in the configuration.
3. Record every entry whose referenced object cannot be resolved.
4. Confirm the object was deleted rather than renamed or moved to another package, since a still-present object should resolve.

Remediation:

1. Confirm each unresolved entry refers to an object that was deliberately deleted.
2. Remove the orphaned rights entries.
3. Add removal of an object’s access rights to the procedure followed when deleting an object, so the condition does not recur.

Default Value: Creatio does not automatically remove configured access rights when the object they refer to is deleted, and does not report their existence.