Top 10 2013-A6-Sensitive Data Exposure - Revision history

T.Gigler: deleted a '#' in at 'How Do I prevent...'; added < br/ > at 'References' (like at A2)

2013-06-23T21:04:00Z

deleted a '#' in at 'How Do I prevent...'; added < br/ > at 'References' (like at A2)

T.Gigler: added '|year=2013 |language=en' at Top/BottomTemplates and 'Ax-' in |next= and prev=

2013-06-14T21:01:00Z

added '|year=2013 |language=en' at Top/BottomTemplates and 'Ax-' in |next= and prev=

Neil Smithline at 14:43, 14 June 2013

2013-06-14T14:43:08Z

T.Gigler: added 'Top_10:SummaryTableTemplate' to get this section easier and to get better prepared for internationalisation. + added '|language=en' to get better prepared for internationalisation.

2013-06-09T11:44:56Z

added 'Top_10:SummaryTableTemplate' to get this section easier and to get better prepared for internationalisation. + added '|language=en' to get better prepared for internationalisation.

T.Gigler: Changed use of Template 'Top_10_2010:SubsectionAdvancedTemplate': Replace Parameter 'number' by 'subsection' and 'position'

2013-04-13T22:54:52Z

Changed use of Template 'Top_10_2010:SubsectionAdvancedTemplate': Replace Parameter 'number' by 'subsection' and 'position'

Neil Smithline at 04:44, 8 March 2013

2013-03-08T04:44:08Z

Neil Smithline at 02:02, 5 March 2013

2013-03-05T02:02:46Z

Neil Smithline at 01:56, 5 March 2013

2013-03-05T01:56:43Z

Neil Smithline at 19:43, 23 February 2013

2013-02-23T19:43:20Z

Neil Smithline at 23:43, 17 February 2013

2013-02-17T23:43:22Z

@@ Line 48: / Line 48: @@
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=6|year=2013|language=en}}
-# The full perils of unsafe cryptography, SSL usage, and data protection are well beyond the scope of the Top 10. That said, for all sensitive data, do all of the following, at a minimum:
+The full perils of unsafe cryptography, SSL usage, and data protection are well beyond the scope of the Top 10. That said, for all sensitive data, do all of the following, at a minimum:
 # Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats.
 # Don’t store sensitive data unnecessarily. Discard it as soon as possible. Data you don’t have can’t be stolen.
@@ Line 62: / Line 62: @@
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=6|year=2013|language=en}}
-{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
+{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}} <br/>
 For a more complete set of requirements, see [https://www.owasp.org/index.php/ASVS  ASVS req’ts on Cryptography (V7), Data Protection (V9)]  and [https://www.owasp.org/index.php/ASVS   Communications Security (V10)]
 * [https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet  OWASP Cryptographic Storage Cheat Sheet]

@@ Line 1: / Line 1: @@
 {{Top_10_2013:TopTemplate
      |usenext=2013NextLink
-     |next={{Top_10_2010:ByTheNumbers
+     |next=A7-{{Top_10_2010:ByTheNumbers
                |7
                |year=2013
                |language=en}}
      |useprev=2013PrevLink
-     |prev={{Top_10_2010:ByTheNumbers
+     |prev=A5-{{Top_10_2010:ByTheNumbers
                |5
                |year=2013
                |language=en}}
 }}
@@ Line 77: / Line 79: @@
      |type={{Top_10_2010:StyleTemplate}}
      |usenext=2013NextLink
-     |next={{Top_10_2010:ByTheNumbers
+     |next=A7-{{Top_10_2010:ByTheNumbers
                |7
                |year=2013
                |language=en}}
      |useprev=2013PrevLink
-     |prev={{Top_10_2010:ByTheNumbers
+     |prev=A5-{{Top_10_2010:ByTheNumbers
                |5
                |year=2013
                |language=en}}
 }}
 [[Category:OWASP Top Ten Project]]

@@ Line 16: / Line 16: @@
 {{Top_10_2010:SummaryTableHeaderEndTemplate|year=2013}}
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Consider who can gain access to your sensitive data and any backups of that data. This includes the data at rest, in transit, and even in your customers’ browsers. Include both external and internal threats.
 </td>
-      <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>The most common flaw is simply not encrypting sensitive data. When crypto is employed, weak key generation and management, and weak algorithm usage is common, particularly weak hashing solutions to protect passwords. Browser weaknesses are very common and easy to detect, but hard to exploit. External attackers have difficulty detecting most of these types of flaws due to limited access and they are also usually hard to exploit.
+      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>
 </td>
-      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Failure frequently compromises all data that should have been protected. Typically this information includes  sensitive data such as health records, credentials, personal data, credit cards, etc.
+      <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>
 </td>
-      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Consider the business value of the lost data and impact to your reputation. What is your legal liability if this data is exposed? Also consider the damage to your reputation.
+      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>
 </td>
 {{Top_10_2010:SummaryTableEndTemplate}}
 {{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=6|year=2013|language=en}}
-The first thing you have to determine is which data is sensitive enough to require extra protection. For example, passwords, credit card numbers, health records, and personal information should be protected. For all such data, ensure:
+The first thing you have to determine is which data is sensitive enough to require extra protection. For example, passwords, credit card numbers, health records, and personal information should be protected. For all such data:
-# It is encrypted everywhere it is stored long term, including backups of this data.
+# Is any of this data stored in clear text long term, including backups of this data?
-# It is encrypted in transit, ideally internally as well as externally. All internet traffic should be encrypted.
+# Is any of this data transmitted in clear text, internally or externally? Internet traffic is especially dangerous.
-# Strong encryption algorithms are used for all crypto.
+# Are any old / weak cryptographic algorithms used?
-# Strong crypto keys are generated, and proper key management is in place, including key rotation.
+# Are weak crypto keys generated, or is proper key management or rotation missing?
-# Proper browser directives and headers are set to protect sensitive data provided by or sent to the browser.
+# Are any browser security directives or headers missing when sensitive data is provided by / sent to the browser?
 And more … For a more complete set of problems to avoid, see [https://www.owasp.org/index.php/ASVS  ASVS areas Crypto (V7), Data Prot. (V9), and SSL (V10)]
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=6|year=2013|language=en}}
-The full perils of unsafe cryptography, SSL usage, and data protection are well beyond the scope of the Top 10. That said, for all sensitive data, do all of the following, at a minimum:
+# The full perils of unsafe cryptography, SSL usage, and data protection are well beyond the scope of the Top 10. That said, for all sensitive data, do all of the following, at a minimum:
 # Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats.
 # Don’t store sensitive data unnecessarily. Discard it as soon as possible. Data you don’t have can’t be stolen.
-# Ensure strong standard algorithms and strong keys are used, and proper key management is in place.
+# Ensure strong standard algorithms and strong keys are used, and proper key management is in place. Consider using [http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm  FIPS 140 validated cryptographic modules].
-Ensure passwords are stored with an algorithm specifically designed for password protection, such as [http://en.wikipedia.org/wiki/Bcrypt  bcrypt], [http://en.wikipedia.org/wiki/PBKDF2  PBKDF2], or [http://en.wikipedia.org/wiki/Scrypt  scrypt].
+# Ensure passwords are stored with an algorithm specifically designed for password protection, such as [http://en.wikipedia.org/wiki/Bcrypt  bcrypt], [http://en.wikipedia.org/wiki/PBKDF2  PBKDF2], or [http://en.wikipedia.org/wiki/Scrypt  scrypt].
-# Disable autocomplete on forms collecting sensitive data and disable caching for pages displaying sensitive data.
+# Disable autocomplete on forms collecting sensitive data and disable caching for pages that contain sensitive data.
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=6|year=2013|language=en}}
-<u>Scenario #1:</u> An application encrypts credit card numbers in a database using automatic database encryption. However, this means it also decrypts this data automatically when retrieved, allowing an SQL injection flaw to retrieve credit card numbers in clear text. The system should have encrypted the credit card numbers using a public key, and only allowed back-end applications to decrypt them with the private key.
+'''Scenario #1:''' An application encrypts credit card numbers in a database using automatic database encryption. However, this means it also decrypts this data automatically when retrieved, allowing an SQL injection flaw to retrieve credit card numbers in clear text. The system should have encrypted the credit card numbers using a public key, and only allowed back-end applications to decrypt them with the private key.
-<u>Scenario #2:</u> A site simply doesn't use SSL for all authenticated pages. Attacker simply monitors network traffic (like an open wireless network), and steals the user’s session cookie. Attacker then replays this cookie and hijacks the user’s session, accessing all their private data.
+'''Scenario #2:''' A site simply doesn’t use SSL for all authenticated pages. Attacker simply monitors network traffic (like an open wireless network), and steals the user’s session cookie. Attacker then replays this cookie and hijacks the user’s session, accessing the user’s private data.
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=6|year=2013|language=en}}
 {{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
-For a more complete set of requirements, see [https://www.owasp.org/index.php/ASVS  ASVS req’ts on Cryptography (V7), Data Protection (V9)]  and  Communications Security (V10)
+For a more complete set of requirements, see [https://www.owasp.org/index.php/ASVS  ASVS req’ts on Cryptography (V7), Data Protection (V9)]  and [https://www.owasp.org/index.php/ASVS   Communications Security (V10)]
-* [https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet  OWASP  Storage Cheat Sheet]
+* [https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet  OWASP Cryptographic Storage Cheat Sheet]
 * [https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet  OWASP Password Storage Cheat Sheet]
 * [https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet  OWASP Transport Layer Protection Cheat Sheet]
 * [https://www.owasp.org/index.php/Testing_for_SSL-TLS  OWASP Testing Guide: Chapter on SSL/TLS Testing]
 {{Top_10_2010:SubSubsectionExternalReferencesTemplate|language=en}}
 * [http://cwe.mitre.org/data/definitions/310.html  CWE Entry 310 on Cryptographic Issues]
@@ Line 61: / Line 71: @@
 * [http://cwe.mitre.org/data/definitions/319.html  CWE Entry 319 on Cleartext Transmission of Sensitive Information]
 * [http://cwe.mitre.org/data/definitions/326.html  CWE Entry 326 on Weak Encryption]

@@ Line 3: / Line 3: @@
      |next={{Top_10_2010:ByTheNumbers
                |7
-               |year=2013}}
+               |year=2013
      |useprev=2013PrevLink
      |prev={{Top_10_2010:ByTheNumbers
                |5
-               |year=2013}}
+               |year=2013
 }}
-{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013}}
+{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013|language=en}}
-{{Top_10_2010:SummaryTableValue-3-Template|Exploitability|DIFFICULT|year=2013}}
+  {{Top_10:SummaryTableTemplate|exploitability=3|prevalence=3|detectability=2|impact=1|year=2013|language=en}}
 {{Top_10_2010:SummaryTableHeaderEndTemplate|year=2013}}
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Consider who can gain access to your sensitive data and any backups of that data. This includes the data at rest, in transit, and even in your customers’ browsers. Include both external and internal threats.
@@ Line 28: / Line 27: @@
 {{Top_10_2010:SummaryTableEndTemplate}}
-{{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=6|year=2013}}
+{{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=6|year=2013|language=en}}
 The first thing you have to determine is which data is sensitive enough to require extra protection. For example, passwords, credit card numbers, health records, and personal information should be protected. For all such data, ensure:
 # It is encrypted everywhere it is stored long term, including backups of this data.
@@ Line 36: / Line 35: @@
 # Proper browser directives and headers are set to protect sensitive data provided by or sent to the browser.
 And more … For a more complete set of problems to avoid, see [https://www.owasp.org/index.php/ASVS  ASVS areas Crypto (V7), Data Prot. (V9), and SSL (V10)]
-{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=6|year=2013}}
+{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=6|year=2013|language=en}}
 The full perils of unsafe cryptography, SSL usage, and data protection are well beyond the scope of the Top 10. That said, for all sensitive data, do all of the following, at a minimum:
 # Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats.
@@ Line 43: / Line 42: @@
 Ensure passwords are stored with an algorithm specifically designed for password protection, such as [http://en.wikipedia.org/wiki/Bcrypt  bcrypt], [http://en.wikipedia.org/wiki/PBKDF2  PBKDF2], or [http://en.wikipedia.org/wiki/Scrypt  scrypt].
 # Disable autocomplete on forms collecting sensitive data and disable caching for pages displaying sensitive data.
-{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=6|year=2013}}
+{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=6|year=2013|language=en}}
 <u>Scenario #1:</u> An application encrypts credit card numbers in a database using automatic database encryption. However, this means it also decrypts this data automatically when retrieved, allowing an SQL injection flaw to retrieve credit card numbers in clear text. The system should have encrypted the credit card numbers using a public key, and only allowed back-end applications to decrypt them with the private key.
@@ Line 49: / Line 48: @@
 <u>Scenario #3:</u> The password database uses unsalted hashes to store everyone’s passwords. A file upload flaw allows an attacker to retrieve the password file. All the unsalted hashes can be exposed with a rainbow table of precalculated hashes.
-{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=6|year=2013}}
+{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=6|year=2013|language=en}}
 {{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
 For a more complete set of requirements, see [https://www.owasp.org/index.php/ASVS  ASVS req’ts on Cryptography (V7), Data Protection (V9)]  and  Communications Security (V10)
@@ Line 57: / Line 56: @@
 * [https://www.owasp.org/index.php/Testing_for_SSL-TLS  OWASP Testing Guide: Chapter on SSL/TLS Testing]
-{{Top_10_2010:SubSubsectionExternalReferencesTemplate}}
+{{Top_10_2010:SubSubsectionExternalReferencesTemplate|language=en}}
 * [http://cwe.mitre.org/data/definitions/310.html  CWE Entry 310 on Cryptographic Issues]
 * [http://cwe.mitre.org/data/definitions/312.html  CWE Entry 312 on Cleartext Storage of Sensitive Information]
@@ Line 69: / Line 68: @@
      |next={{Top_10_2010:ByTheNumbers
                |7
-               |year=2013}}
+               |year=2013
      |useprev=2013PrevLink
      |prev={{Top_10_2010:ByTheNumbers
                |5
-               |year=2013}}}}
+               |year=2013
 [[Category:OWASP Top Ten Project]]

@@ Line 28: / Line 28: @@
 {{Top_10_2010:SummaryTableEndTemplate}}
-{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=1|risk=6|year=2013}}
+{{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=6|year=2013}}
 The first thing you have to determine is which data is sensitive enough to require extra protection. For example, passwords, credit card numbers, health records, and personal information should be protected. For all such data, ensure:
 # It is encrypted everywhere it is stored long term, including backups of this data.
@@ Line 36: / Line 36: @@
 # Proper browser directives and headers are set to protect sensitive data provided by or sent to the browser.
 And more … For a more complete set of problems to avoid, see [https://www.owasp.org/index.php/ASVS  ASVS areas Crypto (V7), Data Prot. (V9), and SSL (V10)]
-{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=2|risk=6|year=2013}}
+{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=6|year=2013}}
 The full perils of unsafe cryptography, SSL usage, and data protection are well beyond the scope of the Top 10. That said, for all sensitive data, do all of the following, at a minimum:
 # Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats.
@@ Line 43: / Line 43: @@
 Ensure passwords are stored with an algorithm specifically designed for password protection, such as [http://en.wikipedia.org/wiki/Bcrypt  bcrypt], [http://en.wikipedia.org/wiki/PBKDF2  PBKDF2], or [http://en.wikipedia.org/wiki/Scrypt  scrypt].
 # Disable autocomplete on forms collecting sensitive data and disable caching for pages displaying sensitive data.
-{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=3|risk=6|year=2013}}
+{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=6|year=2013}}
 <u>Scenario #1:</u> An application encrypts credit card numbers in a database using automatic database encryption. However, this means it also decrypts this data automatically when retrieved, allowing an SQL injection flaw to retrieve credit card numbers in clear text. The system should have encrypted the credit card numbers using a public key, and only allowed back-end applications to decrypt them with the private key.
@@ Line 49: / Line 49: @@
 <u>Scenario #3:</u> The password database uses unsalted hashes to store everyone’s passwords. A file upload flaw allows an attacker to retrieve the password file. All the unsalted hashes can be exposed with a rainbow table of precalculated hashes.
-{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=4|risk=6|year=2013}}
+{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=6|year=2013}}
 {{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
 For a more complete set of requirements, see [https://www.owasp.org/index.php/ASVS  ASVS req’ts on Cryptography (V7), Data Protection (V9)]  and  Communications Security (V10)