This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

OWASP Periodic Table of Vulnerabilities - Insufficient Data Protection

Revision as of 07:55, 29 May 2013 by Peter Mosmans (talk | contribs)

Jump to: navigation, search

Return to Periodic Table Working View

Insufficient Data Protection

Root Cause Summary

Sensitive data is not sufficiently protected against disclosure, modification or non-repudiation.

Browser / Standards Solution

Perimeter Solution


Generic Framework Solution

Provide a configuration-based suite of encryption utilities for all data security needs. This includes safeguards to prevent tampering (with Hash-based Message Authentication Code or HMAC) and eavesdropping (with symmetric or public key encryption).

Custom Framework Solution


Custom Code Solution

Identify which kinds of data need to be protected, for example Personally Identifiable Information (PII) or authentication and identification data. Examples of PII are names, passport numbers, address information and personal characteristics.
Never store more information than is needed. Minimize the use, collection and retention of data.
Use a risk-based approach, order the data by impact level (for example low, moderate and high) if it is to be inappropriately accessed, used or disclosed.
Make sure that all applicable (eg. local, federal) laws are obeyed.

Discussion / Controversy

Data protection laws vary from country to country. Ensure that the correct mitigations and protections have been taken.


Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (European Union)
Guide to Protecting the Confidentiality of Personally Identifiable Information (NIST)