Column rights must not reference columns that no longer exist

Control Statement: Column access rights must not reference columns that are no longer present in the object.

Description: Column rights are stored against the identifier of the column they govern. Removing a column from an object does not necessarily remove the rights configured for it. This control requires that such orphaned entries be identified and removed.

Rationale: Like orphaned object rights, these entries are not directly exploitable and the control exists for assurance. Their specific significance is that they distort the picture of an object’s column-level protection. A reviewer assessing whether an object’s sensitive columns are adequately restricted counts the configured rights; where some of those refer to columns that no longer exist, the object appears more comprehensively protected than it is, and the columns actually present may include ones with no restriction at all.

Audit Procedure:

1. Enumerate the configured column rights together with the column each refers to.
2. Resolve each referenced column against the columns currently present in the object.
3. Record every entry whose referenced column cannot be resolved.
4. Confirm the column was removed rather than renamed, since a renamed column retains its identifier and should still resolve.

Remediation:

1. Confirm each unresolved entry refers to a column that was deliberately removed.
2. Remove the orphaned entries.
3. Re-assess the object’s remaining column rights against the classification recorded under CSB-DATA-001, since removing the orphans may reveal columns with no restriction.
4. Add removal of column rights to the procedure followed when removing a column.

Default Value: Creatio does not automatically remove configured column rights when the column they refer to is removed, and does not report their existence.