This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Top 10-2017 A3-Sensitive Data Exposure"

From OWASP
Jump to: navigation, search
(Moved page back to page to content of 2013-A5 as a reference to compare changes)
(Content of Top-10 2017-RC1 (to compare versions later))
Line 1: Line 1:
 
{{Top_10_2013:TopTemplate
 
{{Top_10_2013:TopTemplate
 
     |usenext=2013NextLink
 
     |usenext=2013NextLink
−
     |next=A6-{{Top_10_2010:ByTheNumbers
+
     |next=A7-{{Top_10_2010:ByTheNumbers
−
               |6
+
               |7
 
               |year=2017
 
               |year=2017
 
               |language=en}}
 
               |language=en}}
 
     |useprev=2013PrevLink
 
     |useprev=2013PrevLink
−
     |prev=A4-{{Top_10_2010:ByTheNumbers
+
     |prev=A5-{{Top_10_2010:ByTheNumbers
−
               |4
+
               |5
 
               |year=2017
 
               |year=2017
 
               |language=en}}
 
               |language=en}}
Line 15: Line 15:
  
 
{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2017|language=en}}
 
{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2017|language=en}}
−
{{Top_10:SummaryTableTemplate|exploitability=1|prevalence=2|detectability=1|impact=2|year=2017|language=en}}
+
  {{Top_10:SummaryTableTemplate|exploitability=3|prevalence=3|detectability=2|impact=1|year=2017|language=en}}
 
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2017}}
 
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2017}}
 
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
−
Consider anonymous external attackers as well as users with their own accounts that may attempt to compromise the system. Also consider insiders wanting to disguise their actions.
+
<!--- Threat Agents: --->Consider who can gain access to your sensitive data and any backups of that data. This includes the data at rest, in transit and even in your customers’ browsers. Include both external and internal threats.
 
</td>
 
</td>
 
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
−
Attacker accesses default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access to or knowledge of the system.
+
<!--- Attack Vectors --->Attackers typically don’t break crypto directly. They break something else, such as steal keys, do man-in-the-middle attacks, or steal clear text data off the server, while in transit, or from the user’s browser.
−
 
 
 
</td>
 
</td>
 
     <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 
     <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
−
Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, database, framework, and custom code. Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc.
+
<!--- Security Weakness --->The most common flaw is simply not encrypting sensitive data. When crypto is employed, weak key generation and management, and weak algorithm usage is common, particularly weak password hashing techniques. Browser weaknesses are very common and easy to detect, but hard to exploit on a large scale. External attackers have difficulty detecting server side flaws due to limited access and they are also usually hard to exploit.  
−
 
 
 
</td>
 
</td>
 
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
−
The system could be completely compromised without you knowing it. All of your data could be stolen or modified slowly over time.  
+
<!--- Technical Impacts --->Failure frequently compromises all data that should have been protected. Typically, this information includes sensitive data such as health records, credentials, personal data, credit cards, etc.
−
 
 
−
Recovery costs could be expensive
 
−
 
 
 
</td>
 
</td>
 
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
−
The system could be completely compromised without you knowing it. All your data could be stolen or modified slowly over time.  
+
<!--- Business Impacts  --->Consider the business value of the lost data and impact to your reputation. What is your legal liability if this data is exposed? Also consider the damage to your reputation.
−
 
+
</td>
−
Recovery costs could be expensive.</td>
 
 
{{Top_10_2010:SummaryTableEndTemplate|year=2017}}
 
{{Top_10_2010:SummaryTableEndTemplate|year=2017}}
  
−
{{Top_10:SubsectionTableBeginTemplate|type=main|year=2017}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=5|year=2017|language=en}}
+
{{Top_10:SubsectionTableBeginTemplate|type=main|year=2017}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=6|year=2017|language=en}}
−
Is your application missing the proper security hardening across any part of the application stack? Including:
+
The first thing you have to determine is which data is sensitive enough to require extra protection. For example, passwords, credit card numbers, health records, and personal information should be protected. For all such data:
−
# Is any of your software out of date? This includes the OS, Web/App Server, DBMS, applications, and all code libraries (see new A9).
+
# Is any of this data stored in clear text long term, including backups of this data?
−
# Are any unnecessary features enabled or installed (e.g., ports, services, pages, accounts, privileges)?
+
# Is any of this data transmitted in clear text, internally or externally? Internet traffic is especially dangerous.
−
# Are default accounts and their passwords still enabled and unchanged?
+
# Are any old / weak cryptographic algorithms used?
−
# Does your error handling reveal stack traces or other overly informative error messages to users?
+
# Are weak crypto keys generated, or is proper key management or rotation missing?
−
# Are the security settings in your development frameworks (e.g., Struts, Spring, ASP.NET) and libraries not set to secure values?
+
# Are any browser security directives or headers missing when sensitive data is provided by / sent to the browser?
−
 
+
And more ... For a more complete set of problems to avoid, see <u>[[ASVS|ASVS areas Crypto (V7), Data Prot (V9), and SSL/TLS (V10)]]</u>.
−
Without a concerted, repeatable application security configuration process, systems are at a higher risk.
 
  
−
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=5|year=2017|language=en}}
+
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=6|year=2017|language=en}}
−
The primary recommendations are to establish all of the following:
+
The full perils of unsafe cryptography, SSL/TLS usage, and data protection are well beyond the scope of the Top 10. That said, for all sensitive data, do the following, at a minimum:
−
# A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically (with different passwords used in each environment). This process should be automated to minimize the effort required to setup a new secure environment.
+
# Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats.
−
# A process for keeping abreast of and deploying all new software updates and patches in a timely manner to each deployed environment. This needs to include '''all code libraries as well (see new A9)'''.
+
# Don’t store sensitive data unnecessarily. Discard it as soon as possible. Data you don’t retain can’t be stolen.
−
# A strong application architecture that provides effective, secure separation between components.
+
# Ensure strong standard algorithms and strong keys are used, and proper key management is in place. Consider using <u>[http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm FIPS 140 validated cryptographic modules]</u>.
−
# Consider running scans and doing audits periodically to help detect future misconfigurations or missing patches.
+
# Ensure passwords are stored with an algorithm specifically designed for password protection, such as <u>[http://en.wikipedia.org/wiki/Bcrypt bcrypt]</u>, <u>[http://en.wikipedia.org/wiki/PBKDF2 PBKDF2]</u>, or <u>[http://en.wikipedia.org/wiki/Scrypt scrypt]</u>.
−
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=5|year=2017|language=en}}
+
# Disable autocomplete on forms requesting sensitive data and disable caching for pages that contain sensitive data.
−
'''Scenario #1:''' The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over.
 
  
−
'''Scenario #2:''' Directory listing is not disabled on your server. Attacker discovers she can simply list directories to find any file. Attacker finds and downloads all your compiled Java classes, which she decompiles and reverse engineers to get all your custom code. She then finds a serious access control flaw in your application.
+
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=6|year=2017|language=en}}
 +
<u>'''Scenario #1:'''</u> An application encrypts credit card numbers in a database using automatic database encryption. However, this data is automatically decrypted when retrieved, allowing an SQL injection flaw to retrieve credit card numbers in clear text. Alternatives include not storing credit card numbers, using tokenization, or using public key encryption.
  
−
'''Scenario #3:''' App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws. Attackers love the extra information error messages provide.
+
<u>'''Scenario #2:'''</u> A site simply doesn’t use TLS for all authenticated pages. An attacker simply monitors network traffic (like an open wireless network), and steals the user’s session cookie. The attacker then replays this cookie and hijacks the user’s session, accessing the user’s private data.
  
−
'''Scenario #4:''' App server comes with sample applications that are not removed from your production server. Said sample applications have well known security flaws attackers can use to compromise your server.
+
<u>'''Scenario #3:'''</u> The password database uses unsalted hashes to store everyone’s passwords. A file upload flaw allows an attacker to retrieve the password database. All of the unsalted hashes can be exposed with a rainbow table of precalculated hashes.
−
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=5|year=2017|language=en}}
 
−
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
 
−
* [https://www.owasp.org/index.php/Configuration  OWASP Development Guide: Chapter on Configuration]
 
−
* [https://www.owasp.org/index.php/Error_Handling  OWASP Code Review Guide: Chapter on Error Handling]
 
−
* [https://www.owasp.org/index.php/Testing_for_configuration_management  OWASP Testing Guide: Configuration Management]
 
−
* [https://www.owasp.org/index.php/Testing_for_Error_Code_(OWASP-IG-006)  OWASP Testing Guide: Testing for Error Codes]
 
−
* [https://www.owasp.org/index.php/A10_2004_Insecure_Configuration_Management  OWASP Top 10 2004 - Insecure Configuration Management ]
 
  
−
For additional requirements in this area, see the [https://www.owasp.org/index.php/ASVS  ASVS requirements area for Security Configuration (V12)].
+
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=6|year=2017|language=en}}
 +
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate|year=2017|language=en}} <br/>
 +
* For a more complete set of requirements, see ASVS req’ts on <u>[[ASVS|Cryptography (V7), Data Protection (V9), and Communications Security (V10)]]</u>
 +
* <u>[[Cryptographic_Storage_Cheat_Sheet|OWASP Cryptographic Storage Cheat Sheet]]</u>
 +
* <u>[[Password_Storage_Cheat_Sheet|OWASP Password Storage Cheat Sheet]]</u>
 +
* <u>[[Transport_Layer_Protection_Cheat_Sheet|OWASP Transport Layer Protection Cheat Sheet]]</u>
 +
* <u>[[Testing_for_SSL-TLS|OWASP Testing Guide: Chapter on SSL/TLS Testing]]</u>
  
−
{{Top_10_2010:SubSubsectionExternalReferencesTemplate|language=en}}
+
{{Top_10_2010:SubSubsectionExternalReferencesTemplate|year=2017|language=en}}
−
* [http://www.pcmag.com/article2/0,2817,11525,00.asp  PC Magazine Article on Web Server Hardening]
+
* <u>[http://cwe.mitre.org/data/definitions/310.html CWE Entry 310 on Cryptographic Issues]</u>
−
* [http://cwe.mitre.org/data/definitions/2.html CWE Entry 2 on Environmental Security Flaws]
+
* <u>[http://cwe.mitre.org/data/definitions/312.html CWE Entry 312 on Cleartext Storage of Sensitive Information]</u>
−
* [http://benchmarks.cisecurity.org/downloads/benchmarks/ CIS Security Configuration Guides/Benchmarks]
+
* <u>[http://cwe.mitre.org/data/definitions/319.html CWE Entry 319 on Cleartext Transmission of Sensitive Information]</u>
 +
* <u>[http://cwe.mitre.org/data/definitions/326.html CWE Entry 326 on Weak Encryption]</u>
  
 
{{Top_10_2013:BottomAdvancedTemplate
 
{{Top_10_2013:BottomAdvancedTemplate
 
     |type={{Top_10_2010:StyleTemplate}}
 
     |type={{Top_10_2010:StyleTemplate}}
 
     |usenext=2013NextLink
 
     |usenext=2013NextLink
−
     |next=A6-{{Top_10_2010:ByTheNumbers
+
     |next=A7-{{Top_10_2010:ByTheNumbers
−
               |6
+
               |7
 
               |year=2017
 
               |year=2017
 
               |language=en}}
 
               |language=en}}
 
     |useprev=2013PrevLink
 
     |useprev=2013PrevLink
−
     |prev=A4-{{Top_10_2010:ByTheNumbers
+
     |prev=A5-{{Top_10_2010:ByTheNumbers
−
               |4
+
               |5
 
               |year=2017
 
               |year=2017
 
               |language=en}}
 
               |language=en}}
Line 94: Line 87:
 
     |language=en
 
     |language=en
 
}}
 
}}
 +
 +
[[Category:OWASP Top Ten Project]]

Revision as of 23:09, 11 December 2017

← A5-Broken Access Control
2017 Table of Contents

PDF version

A7-Cross-Site Scripting (XSS) →
Threat Agents / Attack Vectors Security Weakness Impacts
App Specific Exploitability
DIFFICULT		 Prevalence
UNCOMMON		 Detectability
AVERAGE		 Impact
SEVERE		 Business ?

Consider who can gain access to your sensitive data and any backups of that data. This includes the data at rest, in transit and even in your customers’ browsers. Include both external and internal threats.

Attackers typically don’t break crypto directly. They break something else, such as steal keys, do man-in-the-middle attacks, or steal clear text data off the server, while in transit, or from the user’s browser.

The most common flaw is simply not encrypting sensitive data. When crypto is employed, weak key generation and management, and weak algorithm usage is common, particularly weak password hashing techniques. Browser weaknesses are very common and easy to detect, but hard to exploit on a large scale. External attackers have difficulty detecting server side flaws due to limited access and they are also usually hard to exploit.

Failure frequently compromises all data that should have been protected. Typically, this information includes sensitive data such as health records, credentials, personal data, credit cards, etc.

Consider the business value of the lost data and impact to your reputation. What is your legal liability if this data is exposed? Also consider the damage to your reputation.

Am I Vulnerable To 'Security Misconfiguration'?

The first thing you have to determine is which data is sensitive enough to require extra protection. For example, passwords, credit card numbers, health records, and personal information should be protected. For all such data:

  1. Is any of this data stored in clear text long term, including backups of this data?
  2. Is any of this data transmitted in clear text, internally or externally? Internet traffic is especially dangerous.
  3. Are any old / weak cryptographic algorithms used?
  4. Are weak crypto keys generated, or is proper key management or rotation missing?
  5. Are any browser security directives or headers missing when sensitive data is provided by / sent to the browser?

And more ... For a more complete set of problems to avoid, see ASVS areas Crypto (V7), Data Prot (V9), and SSL/TLS (V10).

How Do I Prevent 'Security Misconfiguration'?

The full perils of unsafe cryptography, SSL/TLS usage, and data protection are well beyond the scope of the Top 10. That said, for all sensitive data, do the following, at a minimum:

  1. Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats.
  2. Don’t store sensitive data unnecessarily. Discard it as soon as possible. Data you don’t retain can’t be stolen.
  3. Ensure strong standard algorithms and strong keys are used, and proper key management is in place. Consider using FIPS 140 validated cryptographic modules.
  4. Ensure passwords are stored with an algorithm specifically designed for password protection, such as bcrypt, PBKDF2, or scrypt.
  5. Disable autocomplete on forms requesting sensitive data and disable caching for pages that contain sensitive data.
Example Attack Scenarios

Scenario #1: An application encrypts credit card numbers in a database using automatic database encryption. However, this data is automatically decrypted when retrieved, allowing an SQL injection flaw to retrieve credit card numbers in clear text. Alternatives include not storing credit card numbers, using tokenization, or using public key encryption.

Scenario #2: A site simply doesn’t use TLS for all authenticated pages. An attacker simply monitors network traffic (like an open wireless network), and steals the user’s session cookie. The attacker then replays this cookie and hijacks the user’s session, accessing the user’s private data.

Scenario #3: The password database uses unsalted hashes to store everyone’s passwords. A file upload flaw allows an attacker to retrieve the password database. All of the unsalted hashes can be exposed with a rainbow table of precalculated hashes.

References

OWASP

External

← A5-Broken Access Control
2017 Table of Contents

PDF version

A7-Cross-Site Scripting (XSS) →
© 2002-2017 OWASP Foundation This document is licensed under the Creative Commons Attribution-ShareAlike 3.0 license. Some rights reserved. CC-by-sa-3 0-88x31.png
Retrieved from "https://wiki.owasp.org/index.php?title=Top_10-2017_A3-Sensitive_Data_Exposure&oldid=236152"