What is sensitive data exposure

Sunday, 18 April 2021

What is sensitive data exposure

Question: What is sensitive data exposure?
Sensitive data exposure happen when an application OR company exposes users's personal data that might be result of no-encryption, weak encryption, software flaws or upload data to public by mistake.

Question: Example of Attack Scenarios?

Someone upload the company data in Facebook/twitter etc by mistake
Transfer of data through HTTP/FTP/SMTP without encryption
Storing the credit card numbers, health records, personal information (email/phone) storing in database without encryption
Encrypting the data with weak cryptographic algorithms or default algorithms
Reuse of cryptographic algorithms OR hash
Is encryption not enforced, e.g. are any user agent (browser) security directives or headers missing
User agent (e.g. app, mail client) not verifying the certificate when received request.

Question: How to Prevent sensitive data exposure?

Identify which data is sensitive according to privacy laws, regulatory requirements, or business needs
Apply controls as per the classification.
Don’t store sensitive data unnecessarily
Make sure to encrypt all sensitive data at rest.
Ensure up-to-date and strong standard algorithms, protocols, and keys are in place; use proper key management.
Encrypt all data in transit with secure protocols such as TLS
Disable caching for response that contain sensitive data
Store passwords using strong adaptive and salted hashing functions.
Verify independently the effectiveness of configuration and settings