Embed Size (px)
Citation preview
Essential security for all software engineers.
Sensitive Data Exposure
2013 OWASP top 10 A-6
Gauthier Befahy
Essential security for all software engineers.
At Secure Coding Academy we have a dream: a vision of a safe and secure IT worldm where all
software engineers will know how to write secure code
Scademy licensed for 360 Training House 3
Intro
Many web applications do not properly protect sensitive data (Such as credit cards information, authentication credentials, PPIs…) with relevant encryption or hashing. As a result, attackers will be able to take advantage of
that and access sensitive data Which, from a business point of view, will result in costs
and loss of reputation.
Scademy licensed for 360 Training House 4
OWASP A-6
Scademy licensed for 360 Training House 5
Unprotected Passwords
Passwords used by Users Should make use of a salt (added randomness) and hashed when
stored in DB. Encryption is not reversible (To protect the User’s password)
Passwords used by Applications Applications connectt o databases and back-end systems using
account IDs and passwords. Encryption is not reversible (To protect the User’s password). They need to be reversible, and make use of symetric algorythms (encryption / decryption)
It Is crucial that they are not stored in clear text, since this exposes the sensitive data, and makes it much easier for the attacker to access it, and then connect to the DB
Scademy licensed for 360 Training House 6
Data leakage and Logging
Data Leakage through memory compiler setting Memset() – An optimized compiler will leave the buffer as a dead code,
resulting in its data being left resident in memory CERT Secure Coding Standard – Do not log sensitive information
outside a trust boundary Logging sensitive data raises many concerns, issues and limitations
regulated by a collection of personal information laws. Sensitive Data (IP addresses; Credentials; email adresses; PCI-DSS
regulation related data) Personally Identifiable Information (Social Security Numbers, ID card
numbers, Passport Numbers, …)
Scademy licensed for 360 Training House 7
Do you want to know more?
Join the Community Contact us at [email protected] Free resources on defences and countermeasures.
Browse our website www.scademy.com Recognized and worldwide training house FOCUSED on Secure
Coding trainings.
www.scademy.com
Join the Secure Coding Academy group on LinkedIn and stay informed about our courses!
Thank you!
Essential security for all software engineers.
Gauthier [email protected]
