Top 10-2017 A3-Sensitive Data Exposure - Revision history

T.Gigler: Editorial changes e.g. added a link

2018-01-01T16:30:44Z

Editorial changes e.g. added a link

T.Gigler: Prepare OWASP Top 10-2017 Release (Content)

2017-12-15T23:20:25Z

Prepare OWASP Top 10-2017 Release (Content)

Show changes

T.Gigler: Updated Navigation (incl PrevLink and NextLink) fixed

2017-12-12T00:33:25Z

Updated Navigation (incl PrevLink and NextLink) fixed

T.Gigler: Updated Navigation (incl PrevLink and NextLink) fixed

2017-12-12T00:31:56Z

Updated Navigation (incl PrevLink and NextLink) fixed

T.Gigler: Updated Navigation (incl PrevLink and NextLink)

2017-12-12T00:21:31Z

Updated Navigation (incl PrevLink and NextLink)

T.Gigler: Content of Top-10 2017-RC1 (to compare versions later)

2017-12-11T23:09:04Z

Content of Top-10 2017-RC1 (to compare versions later)

Show changes

T.Gigler: Moved page back to page to content of 2013-A5 as a reference to compare changes

2017-12-11T23:01:41Z

Moved page back to page to content of 2013-A5 as a reference to compare changes

Show changes

T.Gigler: move from page Top 10 2017-A6-Sensitive Data Exposure

2017-12-11T22:55:39Z

move from page Top 10 2017-A6-Sensitive Data Exposure

T.Gigler: T.Gigler moved page Top 10 2017-A6-Sensitive Data Exposure to Top 10-2017 A3-Sensitive Data Exposure

2017-12-11T22:46:47Z

T.Gigler moved page Top 10 2017-A6-Sensitive Data Exposure to Top 10-2017 A3-Sensitive Data Exposure

T.Gigler: T.Gigler moved page Top 10 2017-A6-Sensitive Data Exposure to Top 10-2017-A3-Sensitive Data Exposure

2017-12-11T22:46:01Z

T.Gigler moved page Top 10 2017-A6-Sensitive Data Exposure to Top 10-2017-A3-Sensitive Data Exposure

New page

#REDIRECT [[Top 10-2017-A3-Sensitive Data Exposure]]

@@ Line 47: / Line 47: @@
 * Make sure to encrypt all sensitive data at rest.
 * Ensure up-to-date and strong standard algorithms, protocols, and keys are in place; use proper key management.
-* Encrypt all data in transit with secure protocols such as TLS with perfect forward secrecy (PFS) ciphers, cipher prioritization by the server, and secure parameters. Enforce encryption using directives like HTTP Strict Transport Security (HSTS).
+* Encrypt all data in transit with secure protocols such as TLS with perfect forward secrecy (PFS) ciphers, cipher prioritization by the server, and secure parameters. Enforce encryption using directives like HTTP Strict Transport Security (<u>[[HTTP_Strict_Transport_Security_Cheat_Sheet|HSTS]]</u>).
 * Disable caching for response that contain sensitive data.
 * Store passwords using strong adaptive and salted hashing functions with a work factor (delay factor), such as <u>[https://www.cryptolux.org/index.php/Argon2 Argon2]</u>, <u>[https://wikipedia.org/wiki/Scrypt scrypt]</u>, <u>[https://wikipedia.org/wiki/Bcrypt bcrypt]</u> or <u>[https://wikipedia.org/wiki/PBKDF2 PBKDF2]</u>.
@@ Line 62: / Line 62: @@
 {{Top_10_2010:SubSubsectionOWASPReferencesTemplate|year=2017|language=en}}
 * <u>[[OWASP_Proactive_Controls#7:_Protect_Data|OWASP Proactive Controls: Protect Data]]</u>
-* <u>[[:Category:OWASP_Application_Security_Verification_Standard_Project|OWASP Application Security Verification Standard]]</u>: <u>[[ASVS_V7_Cryptography|V7]]</u>, <u>[[ASVS_V9_Data_Protection|9]]</u>, <u>[[ASVS_V10_Communications|10]]</u>
+* <u>[[:Category:OWASP_Application_Security_Verification_Standard_Project|OWASP Application Security Verification Standard]]</u> (<u>[[ASVS_V7_Cryptography|V7]]</u>, <u>[[ASVS_V9_Data_Protection|9]]</u>, <u>[[ASVS_V10_Communications|10]]</u>)
 * <u>[[Transport_Layer_Protection_Cheat_Sheet|OWASP Cheat Sheet: Transport Layer Protection]]</u>
 * <u>[[User_Privacy_Protection_Cheat_Sheet|OWASP Cheat Sheet: User Privacy Protection]]</u>
@@ Line 78: / Line 78: @@
 * <u>[https://cwe.mitre.org/data/definitions/326.html CWE-326: Weak Encryption]</u>
 * <u>[https://cwe.mitre.org/data/definitions/327.html CWE-327: Broken/Risky Crypto]</u>
-* <u>[https://cwe.mitre.org/data/definitions/359.html CWE-359: Exposure of Private Information - Privacy Violation]</u>
+* <u>[https://cwe.mitre.org/data/definitions/359.html CWE-359: Exposure of Private Information (Privacy Violation)]</u>
 {{Top_10_2013:BottomAdvancedTemplate

@@ Line 1: / Line 1: @@
 {{Top_10_2013:TopTemplate
      |usenext=2017NextLink
-     |next=A2-{{Top_10_2010:ByTheNumbers
+     |next=A4-{{Top_10_2010:ByTheNumbers
-               |2
+               |4
                |year=2017
                |language=en}}
      |useprev=2017PrevLink
-     |prev=A4-{{Top_10_2010:ByTheNumbers
+     |prev=A2-{{Top_10_2010:ByTheNumbers
-               |4
+               |2
                |year=2017
                |language=en}}
@@ Line 75: / Line 75: @@
      |type={{Top_10_2010:StyleTemplate}}
      |usenext=2017NextLink
-     |next=A2-{{Top_10_2010:ByTheNumbers
+     |next=A4-{{Top_10_2010:ByTheNumbers
-               |2
+               |4
                |year=2017
                |language=en}}
      |useprev=2017PrevLink
-     |prev=A4-{{Top_10_2010:ByTheNumbers
+     |prev=A2-{{Top_10_2010:ByTheNumbers
-               |4
+               |2
                |year=2017
                |language=en}}

@@ Line 1: / Line 1: @@
 {{Top_10_2013:TopTemplate
      |usenext=2017NextLink
-     |next=A7-{{Top_10_2010:ByTheNumbers
+     |next=A2-{{Top_10_2010:ByTheNumbers
                |2
                |year=2017
                |language=en}}
      |useprev=2017PrevLink
-     |prev=A5-{{Top_10_2010:ByTheNumbers
+     |prev=A4-{{Top_10_2010:ByTheNumbers
                |4
                |year=2017
@@ Line 75: / Line 75: @@
      |type={{Top_10_2010:StyleTemplate}}
      |usenext=2017NextLink
-     |next=A7-{{Top_10_2010:ByTheNumbers
+     |next=A2-{{Top_10_2010:ByTheNumbers
                |2
                |year=2017
                |language=en}}
      |useprev=2017PrevLink
-     |prev=A5-{{Top_10_2010:ByTheNumbers
+     |prev=A4-{{Top_10_2010:ByTheNumbers
                |4
                |year=2017

@@ Line 1: / Line 1: @@
 {{Top_10_2013:TopTemplate
-     |usenext=2013NextLink
+     |usenext=2017NextLink
      |next=A7-{{Top_10_2010:ByTheNumbers
-               |7
+               |2
                |year=2017
                |language=en}}
-     |useprev=2013PrevLink
+     |useprev=2017PrevLink
      |prev=A5-{{Top_10_2010:ByTheNumbers
-               |5
+               |4
                |year=2017
                |language=en}}
@@ Line 74: / Line 74: @@
 {{Top_10_2013:BottomAdvancedTemplate
      |type={{Top_10_2010:StyleTemplate}}
-     |usenext=2013NextLink
+     |usenext=2017NextLink
      |next=A7-{{Top_10_2010:ByTheNumbers
-               |7
+               |2
                |year=2017
                |language=en}}
-     |useprev=2013PrevLink
+     |useprev=2017PrevLink
      |prev=A5-{{Top_10_2010:ByTheNumbers
-               |5
+               |4
                |year=2017
                |language=en}}

← Older revision		Revision as of 22:55, 11 December 2017
Line 1:		Line 1:
−	#~~REDIRECT~~ [[Top 10-2017-A3-~~Sensitive Data Exposure~~]]	+	{{Top_10_2013:TopTemplate
		+	\|usenext=2013NextLink
		+	\|next=A7-{{Top_10_2010:ByTheNumbers
		+	\|7
		+	\|year=2017
		+	\|language=en}}
		+	\|useprev=2013PrevLink
		+	\|prev=A5-{{Top_10_2010:ByTheNumbers
		+	\|5
		+	\|year=2017
		+	\|language=en}}
		+	\|year=2017
		+	\|language=en
		+	}}
		+
		+	{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2017\|language=en}}
		+	{{Top_10:SummaryTableTemplate\|exploitability=3\|prevalence=3\|detectability=2\|impact=1\|year=2017\|language=en}}
		+	{{Top_10_2010:SummaryTableHeaderEndTemplate\|year=2017}}
		+	<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate\|year=2017}}>
		+	<!--- Threat Agents: --->Consider who can gain access to your sensitive data and any backups of that data. This includes the data at rest, in transit and even in your customers’ browsers. Include both external and internal threats.
		+	</td>
		+	<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate\|year=2017}}>
		+	<!--- Attack Vectors --->Attackers typically don’t break crypto directly. They break something else, such as steal keys, do man-in-the-middle attacks, or steal clear text data off the server, while in transit, or from the user’s browser.
		+	</td>
		+	<td colspan=2 {{Template:Top 10 2010:SummaryTableRowStyleTemplate\|year=2017}}>
		+	<!--- Security Weakness --->The most common flaw is simply not encrypting sensitive data. When crypto is employed, weak key generation and management, and weak algorithm usage is common, particularly weak password hashing techniques. Browser weaknesses are very common and easy to detect, but hard to exploit on a large scale. External attackers have difficulty detecting server side flaws due to limited access and they are also usually hard to exploit.
		+	</td>
		+	<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate\|year=2017}}>
		+	<!--- Technical Impacts --->Failure frequently compromises all data that should have been protected. Typically, this information includes sensitive data such as health records, credentials, personal data, credit cards, etc.
		+	</td>
		+	<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate\|year=2017}}>
		+	<!--- Business Impacts --->Consider the business value of the lost data and impact to your reputation. What is your legal liability if this data is exposed? Also consider the damage to your reputation.
		+	</td>
		+	{{Top_10_2010:SummaryTableEndTemplate\|year=2017}}
		+
		+	{{Top_10:SubsectionTableBeginTemplate\|type=main\|year=2017}} {{Top_10_2010:SubsectionAdvancedTemplate\|type={{Top_10_2010:StyleTemplate}}\|subsection=vulnerableTo\|position=firstLeft\|risk=6\|year=2017\|language=en}}
		+	The first thing you have to determine is which data is sensitive enough to require extra protection. For example, passwords, credit card numbers, health records, and personal information should be protected. For all such data:
		+	# Is any of this data stored in clear text long term, including backups of this data?
		+	# Is any of this data transmitted in clear text, internally or externally? Internet traffic is especially dangerous.
		+	# Are any old / weak cryptographic algorithms used?
		+	# Are weak crypto keys generated, or is proper key management or rotation missing?
		+	# Are any browser security directives or headers missing when sensitive data is provided by / sent to the browser?
		+	And more ... For a more complete set of problems to avoid, see <u>[[ASVS\|ASVS areas Crypto (V7), Data Prot (V9), and SSL/TLS (V10)]]</u>.
		+
		+	{{Top_10_2010:SubsectionAdvancedTemplate\|type={{Top_10_2010:StyleTemplate}}\|subsection=howPrevent\|position=right\|risk=6\|year=2017\|language=en}}
		+	The full perils of unsafe cryptography, SSL/TLS usage, and data protection are well beyond the scope of the Top 10. That said, for all sensitive data, do the following, at a minimum:
		+	# Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats.
		+	# Don’t store sensitive data unnecessarily. Discard it as soon as possible. Data you don’t retain can’t be stolen.
		+	# Ensure strong standard algorithms and strong keys are used, and proper key management is in place. Consider using <u>[http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm FIPS 140 validated cryptographic modules]</u>.
		+	# Ensure passwords are stored with an algorithm specifically designed for password protection, such as <u>[http://en.wikipedia.org/wiki/Bcrypt bcrypt]</u>, <u>[http://en.wikipedia.org/wiki/PBKDF2 PBKDF2]</u>, or <u>[http://en.wikipedia.org/wiki/Scrypt scrypt]</u>.
		+	# Disable autocomplete on forms requesting sensitive data and disable caching for pages that contain sensitive data.
		+
		+	{{Top_10_2010:SubsectionAdvancedTemplate\|type={{Top_10_2010:StyleTemplate}}\|subsection=example\|position=left\|risk=6\|year=2017\|language=en}}
		+	<u>'''Scenario #1:'''</u> An application encrypts credit card numbers in a database using automatic database encryption. However, this data is automatically decrypted when retrieved, allowing an SQL injection flaw to retrieve credit card numbers in clear text. Alternatives include not storing credit card numbers, using tokenization, or using public key encryption.
		+
		+	<u>'''Scenario #2:'''</u> A site simply doesn’t use TLS for all authenticated pages. An attacker simply monitors network traffic (like an open wireless network), and steals the user’s session cookie. The attacker then replays this cookie and hijacks the user’s session, accessing the user’s private data.
		+
		+	<u>'''Scenario #3:'''</u> The password database uses unsalted hashes to store everyone’s passwords. A file upload flaw allows an attacker to retrieve the password database. All of the unsalted hashes can be exposed with a rainbow table of precalculated hashes.
		+
		+	{{Top_10_2010:SubsectionAdvancedTemplate\|type={{Top_10_2010:StyleTemplate}}\|subsection=references\|position=right\|risk=6\|year=2017\|language=en}}
		+	{{Top_10_2010:SubSubsectionOWASPReferencesTemplate\|year=2017\|language=en}} <br/>
		+	* For a more complete set of requirements, see ASVS req’ts on <u>[[ASVS\|Cryptography (V7), Data Protection (V9), and Communications Security (V10)]]</u>
		+	* <u>[[Cryptographic_Storage_Cheat_Sheet\|OWASP Cryptographic Storage Cheat Sheet]]</u>
		+	* <u>[[Password_Storage_Cheat_Sheet\|OWASP Password Storage Cheat Sheet]]</u>
		+	* <u>[[Transport_Layer_Protection_Cheat_Sheet\|OWASP Transport Layer Protection Cheat Sheet]]</u>
		+	* <u>[[Testing_for_SSL-TLS\|OWASP Testing Guide: Chapter on SSL/TLS Testing]]</u>
		+
		+	{{Top_10_2010:SubSubsectionExternalReferencesTemplate\|year=2017\|language=en}}
		+	* <u>[http://cwe.mitre.org/data/definitions/310.html CWE Entry 310 on Cryptographic Issues]</u>
		+	* <u>[http://cwe.mitre.org/data/definitions/312.html CWE Entry 312 on Cleartext Storage of Sensitive Information]</u>
		+	* <u>[http://cwe.mitre.org/data/definitions/319.html CWE Entry 319 on Cleartext Transmission of Sensitive Information]</u>
		+	* <u>[http://cwe.mitre.org/data/definitions/326.html CWE Entry 326 on Weak Encryption]</u>
		+
		+	{{Top_10_2013:BottomAdvancedTemplate
		+	\|type={{Top_10_2010:StyleTemplate}}
		+	\|usenext=2013NextLink
		+	\|next=A7-{{Top_10_2010:ByTheNumbers
		+	\|7
		+	\|year=2017
		+	\|language=en}}
		+	\|useprev=2013PrevLink
		+	\|prev=A5-{{Top_10_2010:ByTheNumbers
		+	\|5
		+	\|year=2017
		+	\|language=en}}
		+	\|year=2017
		+	\|language=en
		+	}}
		+
		+	[[Category:OWASP Top Ten Project]]

← Older revision	Revision as of 22:46, 11 December 2017
(No difference)