Coders Conquer Security: Share & Learn Series - Sensitive Data Exposure
Sensitive data exposure has been responsible for some of the most publicized and impactful data breaches over the past few years, like the catastrophic Marriott breach wherein over 300 million customer records were stolen, and another 150 million when Equifax was attacked. There is a medium level of sophistication required, and sometimes special equipment on the part of the attacker, but it's not overly hard for a hacker to pull off in many cases, and tools exist to automate some of the attack functions.
Sensitive data exposure occurs whenever information that is only meant for authorized viewing is exposed to an unauthorized person in an unencrypted, unprotected, or weakly protected state. Most of the time this involves data that hackers want to steal such as credit card numbers, user identification, business secrets and personal information that might be protected by laws and industry regulations.
Hackers can steal sensitive information if it is stored without encryption or by indirectly attacking the encryption scheme. Instead of trying to decrypt strong encryption directly, they instead steal crypto keys, or attack data when it's moved to a non-encrypted state such as when it's being readied for transport.
In this episode we will learn:
- How attackers can trigger sensitive data exposure
- Why sensitive data exposure is so dangerous
- Techniques that can fix this vulnerability.
How do Attackers Exploit Sensitive Data Exposure?
Sensitive data exposure normally happens when sites don't employ strong end-to-end encryption to protect data, or when there are exploitable flaws in the protection scheme. It can also happen when the encryption used is particularly weak or outdated.
Hackers will often try and find ways to get around encryption if it's not extended everywhere. For example, if a user identity database stores information in an encrypted state, but automatically decrypts it when retrieved, a hacker might be able to use one of the attacks we previously covered in these blogs, such as SQL or XML injection, to order the database to perform the decryption process. Then the data would be decrypted for the hacker, with no additional effort required. Why try and break down a steel door when you can just pickpocket the key?
Weak encryption is also a problem. For example, if credit cards are stored using an outdated encryption scheme, it could be an issue if a hacker is able to use something like a local file inclusion vulnerability to pull the entire database over to their computer. If the captured data was protected using something strong like AES-256 bit encryption, then it would be much harder to break if it landed in a hacker's possession. But if weaker or outdated encryption is used, something like the older DES standard, then a hacker with special equipment such as a rack of graphics processing units (GPUs) can task them to break the encryption in a relatively short amount of time.
Why is Sensitive Data Exposure Dangerous?
Sensitive data exposure is dangerous because it lets unauthorized users see protected information. If the data wasn't important, it wouldn't be protected, so any breach of that protection is going to cause problems. It's never a situation that an organization wants to find itself facing.
How much trouble a sensitive data exposure can cause depends on the kind of data that gets exposed. If user or password data is stolen, then that could be used to launch further attacks against the system. Personal information exposure could subject users to secondary attacks such as identity theft or phishing. Organizations might even find themselves vulnerable to heavy fines and government actions if the exposed data is legally protected by statutes like the Health Insurance Portability and Accountability Act (HIPAA) in the United States or the General Data Protection Regulation (GDPR) in Europe.
Eliminating Sensitive Data Exposure
Stopping sensitive data exposure begins with ensuring strong, up-to-date and end-to-end encryption of sensitive data across an enterprise. This includes both data at rest and in transit. It's not enough to encrypt sensitive data while it sits in storage. If it is unencrypted before use or before transport, then it can be exposed using a secondary attack that tricks a server into unencrypting it.
Data in transit should always be protected using Transport Layer Security (TLS) to prevent exposure using man in the middle or other attacks against moving data. And sensitive data should never be cached anywhere in the network. Sensitive data should either be sitting with strong encryption in storage or sent using TLS protection, giving attackers no weak points to exploit.
Finally, do an inventory of the kinds of sensitive data that is being protected by your organization. If there is no reason for your organization to store such data, then dump it. Why expose yourself to potential trouble for no possible benefit? Data that isn't maintained by an origination can't be stolen from it.
More Information about Sensitive Data Exposure
For further reading, you can take a look at what OWASP says about sensitive data exposure. You can also put your newfound defensive knowledge to the test with the free demo of the Secure Code Warrior platform, which trains cybersecurity teams to become the ultimate cyber warriors. To learn more about defeating this vulnerability, and a rogues'gallery of other threats, visit the Secure Code Warrior blog.
Sensitive data exposure occurs whenever information that is only meant for authorized viewing is exposed to an unauthorized person in an unencrypted, unprotected, or weakly protected state.
Jaap Karan Singh is a Secure Coding Evangelist, Chief Singh and co-founder of Secure Code Warrior.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoJaap Karan Singh is a Secure Coding Evangelist, Chief Singh and co-founder of Secure Code Warrior.
Sensitive data exposure has been responsible for some of the most publicized and impactful data breaches over the past few years, like the catastrophic Marriott breach wherein over 300 million customer records were stolen, and another 150 million when Equifax was attacked. There is a medium level of sophistication required, and sometimes special equipment on the part of the attacker, but it's not overly hard for a hacker to pull off in many cases, and tools exist to automate some of the attack functions.
Sensitive data exposure occurs whenever information that is only meant for authorized viewing is exposed to an unauthorized person in an unencrypted, unprotected, or weakly protected state. Most of the time this involves data that hackers want to steal such as credit card numbers, user identification, business secrets and personal information that might be protected by laws and industry regulations.
Hackers can steal sensitive information if it is stored without encryption or by indirectly attacking the encryption scheme. Instead of trying to decrypt strong encryption directly, they instead steal crypto keys, or attack data when it's moved to a non-encrypted state such as when it's being readied for transport.
In this episode we will learn:
- How attackers can trigger sensitive data exposure
- Why sensitive data exposure is so dangerous
- Techniques that can fix this vulnerability.
How do Attackers Exploit Sensitive Data Exposure?
Sensitive data exposure normally happens when sites don't employ strong end-to-end encryption to protect data, or when there are exploitable flaws in the protection scheme. It can also happen when the encryption used is particularly weak or outdated.
Hackers will often try and find ways to get around encryption if it's not extended everywhere. For example, if a user identity database stores information in an encrypted state, but automatically decrypts it when retrieved, a hacker might be able to use one of the attacks we previously covered in these blogs, such as SQL or XML injection, to order the database to perform the decryption process. Then the data would be decrypted for the hacker, with no additional effort required. Why try and break down a steel door when you can just pickpocket the key?
Weak encryption is also a problem. For example, if credit cards are stored using an outdated encryption scheme, it could be an issue if a hacker is able to use something like a local file inclusion vulnerability to pull the entire database over to their computer. If the captured data was protected using something strong like AES-256 bit encryption, then it would be much harder to break if it landed in a hacker's possession. But if weaker or outdated encryption is used, something like the older DES standard, then a hacker with special equipment such as a rack of graphics processing units (GPUs) can task them to break the encryption in a relatively short amount of time.
Why is Sensitive Data Exposure Dangerous?
Sensitive data exposure is dangerous because it lets unauthorized users see protected information. If the data wasn't important, it wouldn't be protected, so any breach of that protection is going to cause problems. It's never a situation that an organization wants to find itself facing.
How much trouble a sensitive data exposure can cause depends on the kind of data that gets exposed. If user or password data is stolen, then that could be used to launch further attacks against the system. Personal information exposure could subject users to secondary attacks such as identity theft or phishing. Organizations might even find themselves vulnerable to heavy fines and government actions if the exposed data is legally protected by statutes like the Health Insurance Portability and Accountability Act (HIPAA) in the United States or the General Data Protection Regulation (GDPR) in Europe.
Eliminating Sensitive Data Exposure
Stopping sensitive data exposure begins with ensuring strong, up-to-date and end-to-end encryption of sensitive data across an enterprise. This includes both data at rest and in transit. It's not enough to encrypt sensitive data while it sits in storage. If it is unencrypted before use or before transport, then it can be exposed using a secondary attack that tricks a server into unencrypting it.
Data in transit should always be protected using Transport Layer Security (TLS) to prevent exposure using man in the middle or other attacks against moving data. And sensitive data should never be cached anywhere in the network. Sensitive data should either be sitting with strong encryption in storage or sent using TLS protection, giving attackers no weak points to exploit.
Finally, do an inventory of the kinds of sensitive data that is being protected by your organization. If there is no reason for your organization to store such data, then dump it. Why expose yourself to potential trouble for no possible benefit? Data that isn't maintained by an origination can't be stolen from it.
More Information about Sensitive Data Exposure
For further reading, you can take a look at what OWASP says about sensitive data exposure. You can also put your newfound defensive knowledge to the test with the free demo of the Secure Code Warrior platform, which trains cybersecurity teams to become the ultimate cyber warriors. To learn more about defeating this vulnerability, and a rogues'gallery of other threats, visit the Secure Code Warrior blog.
Sensitive data exposure has been responsible for some of the most publicized and impactful data breaches over the past few years, like the catastrophic Marriott breach wherein over 300 million customer records were stolen, and another 150 million when Equifax was attacked. There is a medium level of sophistication required, and sometimes special equipment on the part of the attacker, but it's not overly hard for a hacker to pull off in many cases, and tools exist to automate some of the attack functions.
Sensitive data exposure occurs whenever information that is only meant for authorized viewing is exposed to an unauthorized person in an unencrypted, unprotected, or weakly protected state. Most of the time this involves data that hackers want to steal such as credit card numbers, user identification, business secrets and personal information that might be protected by laws and industry regulations.
Hackers can steal sensitive information if it is stored without encryption or by indirectly attacking the encryption scheme. Instead of trying to decrypt strong encryption directly, they instead steal crypto keys, or attack data when it's moved to a non-encrypted state such as when it's being readied for transport.
In this episode we will learn:
- How attackers can trigger sensitive data exposure
- Why sensitive data exposure is so dangerous
- Techniques that can fix this vulnerability.
How do Attackers Exploit Sensitive Data Exposure?
Sensitive data exposure normally happens when sites don't employ strong end-to-end encryption to protect data, or when there are exploitable flaws in the protection scheme. It can also happen when the encryption used is particularly weak or outdated.
Hackers will often try and find ways to get around encryption if it's not extended everywhere. For example, if a user identity database stores information in an encrypted state, but automatically decrypts it when retrieved, a hacker might be able to use one of the attacks we previously covered in these blogs, such as SQL or XML injection, to order the database to perform the decryption process. Then the data would be decrypted for the hacker, with no additional effort required. Why try and break down a steel door when you can just pickpocket the key?
Weak encryption is also a problem. For example, if credit cards are stored using an outdated encryption scheme, it could be an issue if a hacker is able to use something like a local file inclusion vulnerability to pull the entire database over to their computer. If the captured data was protected using something strong like AES-256 bit encryption, then it would be much harder to break if it landed in a hacker's possession. But if weaker or outdated encryption is used, something like the older DES standard, then a hacker with special equipment such as a rack of graphics processing units (GPUs) can task them to break the encryption in a relatively short amount of time.
Why is Sensitive Data Exposure Dangerous?
Sensitive data exposure is dangerous because it lets unauthorized users see protected information. If the data wasn't important, it wouldn't be protected, so any breach of that protection is going to cause problems. It's never a situation that an organization wants to find itself facing.
How much trouble a sensitive data exposure can cause depends on the kind of data that gets exposed. If user or password data is stolen, then that could be used to launch further attacks against the system. Personal information exposure could subject users to secondary attacks such as identity theft or phishing. Organizations might even find themselves vulnerable to heavy fines and government actions if the exposed data is legally protected by statutes like the Health Insurance Portability and Accountability Act (HIPAA) in the United States or the General Data Protection Regulation (GDPR) in Europe.
Eliminating Sensitive Data Exposure
Stopping sensitive data exposure begins with ensuring strong, up-to-date and end-to-end encryption of sensitive data across an enterprise. This includes both data at rest and in transit. It's not enough to encrypt sensitive data while it sits in storage. If it is unencrypted before use or before transport, then it can be exposed using a secondary attack that tricks a server into unencrypting it.
Data in transit should always be protected using Transport Layer Security (TLS) to prevent exposure using man in the middle or other attacks against moving data. And sensitive data should never be cached anywhere in the network. Sensitive data should either be sitting with strong encryption in storage or sent using TLS protection, giving attackers no weak points to exploit.
Finally, do an inventory of the kinds of sensitive data that is being protected by your organization. If there is no reason for your organization to store such data, then dump it. Why expose yourself to potential trouble for no possible benefit? Data that isn't maintained by an origination can't be stolen from it.
More Information about Sensitive Data Exposure
For further reading, you can take a look at what OWASP says about sensitive data exposure. You can also put your newfound defensive knowledge to the test with the free demo of the Secure Code Warrior platform, which trains cybersecurity teams to become the ultimate cyber warriors. To learn more about defeating this vulnerability, and a rogues'gallery of other threats, visit the Secure Code Warrior blog.
Click on the link below and download the PDF of this resource.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
View reportBook a demoJaap Karan Singh is a Secure Coding Evangelist, Chief Singh and co-founder of Secure Code Warrior.
Sensitive data exposure has been responsible for some of the most publicized and impactful data breaches over the past few years, like the catastrophic Marriott breach wherein over 300 million customer records were stolen, and another 150 million when Equifax was attacked. There is a medium level of sophistication required, and sometimes special equipment on the part of the attacker, but it's not overly hard for a hacker to pull off in many cases, and tools exist to automate some of the attack functions.
Sensitive data exposure occurs whenever information that is only meant for authorized viewing is exposed to an unauthorized person in an unencrypted, unprotected, or weakly protected state. Most of the time this involves data that hackers want to steal such as credit card numbers, user identification, business secrets and personal information that might be protected by laws and industry regulations.
Hackers can steal sensitive information if it is stored without encryption or by indirectly attacking the encryption scheme. Instead of trying to decrypt strong encryption directly, they instead steal crypto keys, or attack data when it's moved to a non-encrypted state such as when it's being readied for transport.
In this episode we will learn:
- How attackers can trigger sensitive data exposure
- Why sensitive data exposure is so dangerous
- Techniques that can fix this vulnerability.
How do Attackers Exploit Sensitive Data Exposure?
Sensitive data exposure normally happens when sites don't employ strong end-to-end encryption to protect data, or when there are exploitable flaws in the protection scheme. It can also happen when the encryption used is particularly weak or outdated.
Hackers will often try and find ways to get around encryption if it's not extended everywhere. For example, if a user identity database stores information in an encrypted state, but automatically decrypts it when retrieved, a hacker might be able to use one of the attacks we previously covered in these blogs, such as SQL or XML injection, to order the database to perform the decryption process. Then the data would be decrypted for the hacker, with no additional effort required. Why try and break down a steel door when you can just pickpocket the key?
Weak encryption is also a problem. For example, if credit cards are stored using an outdated encryption scheme, it could be an issue if a hacker is able to use something like a local file inclusion vulnerability to pull the entire database over to their computer. If the captured data was protected using something strong like AES-256 bit encryption, then it would be much harder to break if it landed in a hacker's possession. But if weaker or outdated encryption is used, something like the older DES standard, then a hacker with special equipment such as a rack of graphics processing units (GPUs) can task them to break the encryption in a relatively short amount of time.
Why is Sensitive Data Exposure Dangerous?
Sensitive data exposure is dangerous because it lets unauthorized users see protected information. If the data wasn't important, it wouldn't be protected, so any breach of that protection is going to cause problems. It's never a situation that an organization wants to find itself facing.
How much trouble a sensitive data exposure can cause depends on the kind of data that gets exposed. If user or password data is stolen, then that could be used to launch further attacks against the system. Personal information exposure could subject users to secondary attacks such as identity theft or phishing. Organizations might even find themselves vulnerable to heavy fines and government actions if the exposed data is legally protected by statutes like the Health Insurance Portability and Accountability Act (HIPAA) in the United States or the General Data Protection Regulation (GDPR) in Europe.
Eliminating Sensitive Data Exposure
Stopping sensitive data exposure begins with ensuring strong, up-to-date and end-to-end encryption of sensitive data across an enterprise. This includes both data at rest and in transit. It's not enough to encrypt sensitive data while it sits in storage. If it is unencrypted before use or before transport, then it can be exposed using a secondary attack that tricks a server into unencrypting it.
Data in transit should always be protected using Transport Layer Security (TLS) to prevent exposure using man in the middle or other attacks against moving data. And sensitive data should never be cached anywhere in the network. Sensitive data should either be sitting with strong encryption in storage or sent using TLS protection, giving attackers no weak points to exploit.
Finally, do an inventory of the kinds of sensitive data that is being protected by your organization. If there is no reason for your organization to store such data, then dump it. Why expose yourself to potential trouble for no possible benefit? Data that isn't maintained by an origination can't be stolen from it.
More Information about Sensitive Data Exposure
For further reading, you can take a look at what OWASP says about sensitive data exposure. You can also put your newfound defensive knowledge to the test with the free demo of the Secure Code Warrior platform, which trains cybersecurity teams to become the ultimate cyber warriors. To learn more about defeating this vulnerability, and a rogues'gallery of other threats, visit the Secure Code Warrior blog.
Table of contents
Jaap Karan Singh is a Secure Coding Evangelist, Chief Singh and co-founder of Secure Code Warrior.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoDownloadResources to get you started
Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise
The Secure-by-Design movement is the future of secure software development. Learn about the key elements companies need to keep in mind when they think about a Secure-by-Design initiative.
DigitalOcean Decreases Security Debt with Secure Code Warrior
DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.
Resources to get you started
The Benefits of Benchmarking Security Skills for Developers
The growing focus on secure code and Secure-by-Design principles requires developers to be trained in cybersecurity from the start of the SDLC, with tools like Secure Code Warrior’s Trust Score helping measure and improve their progress.
Driving Meaningful Success for Enterprise Secure-by-Design Initiatives
Our latest research paper, Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise is the result of deep analysis of real Secure-by-Design initiatives at the enterprise level, and deriving best practice approaches based on data-driven findings.
Deep Dive: Navigating the Critical CUPS Vulnerability in GNU-Linux Systems
Discover the latest security challenges facing Linux users as we explore recent high-severity vulnerabilities in the Common UNIX Printing System (CUPS). Learn how these issues may lead to potential Remote Code Execution (RCE) and what you can do to protect your systems.
Coders Conquer Security: Share & Learn - Cross-Site Scripting (XSS)
Cross-site scripting (XSS) uses the trust of browsers and ignorance of users to steal data, take over accounts, and deface websites; it's a vulnerability that can get very ugly, very quickly. Let's take a look at how XSS works, what damage can be done, and how to prevent it.