Insecure Cryptographic Storage & Security | Secure Code Warrior

Data is the lifeblood of businesses. It's the foundational information needed for survival, to make money, and to provide services to their customers. In this increasingly digital-focused society, developers have immense responsibility as the stewards of this precious information. When developers don't protect confidential data, the business falls prey to insecure cryptographic storage.

Let's take a look at how to securely store data, and what can happen when you don't.

Understand Insecure Cryptographic Storage

When attackers gain access to a system, they're typically on the hunt for data of value. You know - the type of data that can be used to take over someone's account, or used to execute another attack. Sometimes, this kind of data is simply sold on the black market for quick cash.

Insecure cryptographic storage is not a single vulnerability like SQL injection or XSS. It is a consequence of not protecting the data you should be protecting, in the way you need to protect it.

Sensitive information must be protected. When you store passwords and credit card information in plaintext, you are playing Russian roulette with your business.

If a hacker breaks into your database and steals data using SQL injection, XML injection or any other attack, they'll have everything. However, if you encrypt your data, they'll have a much tougher time making any real use of it.

It's important to note that breaches are not always the result of a malicious outsider. A rogue insider can also steal data with ease if it isn't encrypted. Employees at your company don't need to see everything in the database, and inadequate access controls or exposed sensitive data can lead to outright theft.

Remember, too, that all encryption is not equal. Using the wrong cryptographic algorithms is just as dangerous as not using them at all. Known weak algorithms will offer little resistance to savvy attackers.

Why Insecure Cryptographic Storage is Dangerous

Many companies are compromised by another vulnerability (such as SQL injection) and end up unable to hide the data that was stolen. This makes a terrible situation even worse.

• Adult Friend Finder was breached, leaking 412 million accounts. The passwords for the accounts were protected with the weak SHA-1 hashing algorithm. They were easily cracked by attackers within a month.
• Uber was breached, leaking 57 million user records and 600,000 driver records. Personal information was lost. It happened because Uber's GitHub account had a repository containing Uber's AWS account username and password out in the open... not a good idea. Uber's valuation dropped by $20 billion, largely due to this breach.
• Sony's PlayStation Network was breached, leaking 77 million accounts. 12 million of the accounts contained unencrypted credit card information. Sony later settled a $15 million class-action lawsuit for the breach.

There are clearly severe consequences for not storing sensitive data properly.

Sony was sued, which is a significant penalty. However, even if you aren't sued, the reputational and regulatory damage could be catastrophic for a business.

Defeat Insecure Cryptographic Storage

How can developers prevent data breaches like those above from happening?

The first step is to identify which data requires encryption in the first place. After all, not all data is equal. Categorize your data, then use encryption where appropriate.

In general, personal information like social security numbers, passwords and credit card details must be protected. Depending on the nature of your business, you may need to protect health records or other information that is considered private.

Once you know what data needs to be protected, the next step is using the right tools to ensure its security. In general, it's good to stick to cryptographic algorithms which have stood the test of time and are considered strong.

No matter what, do not write your own cryptographic functions. They're likely to contain flaws attackers can use to break encryption.

To encrypt data such as social security numbers or credit card data, use AES. There are different modes of operation for AES, a highly recommended mode at the time of writing is Galois/Counter Mode (GCM). Another tip is to ensure no padding is used for libraries that ask you to choose a type of padding.

For passwords, use a hash algorithm to hash passwords because hashes cannot be reversed. Given a strongly hashed value, an attacker can't retrieve the original text that created the value. Argon2and Bcryptare considered solid choices for hashing passwords. Remember to always "salt" the password with a random value before hashing so no two hashes are alike for the same password.

These functions will have implementations for all major programming languages/frameworks. Check out the documentation for your specific language or framework for information on how to use them effectively.

Key generation, storage, and management are important components of cryptography. Poorly managed keys can be exposed and used to decrypt your data. Some frameworks help with key management, such as ASP.NET's Data Protection API. For general best practices for key management, check out OWASP's cheat sheet.

Securely storing your data is how you prevent costly, embarrassing data breaches. In the worst-case scenario, if an attacker is able to steal your data, they will have a much more difficult time seeing or using it for any nefarious purpose.

Hide Your Data in Plain Sight

Let's quickly review how to protect your data:

• Categorize your data so you know what requires protection
• Use strong, industry-vetted algorithms for encrypting sensitive data
• Store your passwords using strong one-way hashes

To further study the subject, check out our Learning Resources. When you're ready to dig in and practice, try out our platform in your preferred language. We cover a lot!

With these tools, you can prevent your data from being stolen and prevent your company from losing money and damaging its reputation.

Ready to find and fix insecure cryptographic storage right now? Head to the arena and test your skills [start here]