#2
A02:2021
Cryptographic Failures
Failures related to cryptography which often lead to sensitive data exposure. This was previously known as Sensitive Data Exposure.
概要
Shifting up one position to #2, previously known as Sensitive Data Exposure. The focus is on failures related to cryptography which often leads to sensitive data exposure or system compromise.
攻撃者がこれを悪用する方法
攻撃パターンを理解することで、より優れた防御を構築できます。これらはセキュリティチームが監視する技術です。
Data exposure in transit
Sensitive data transmitted over unencrypted connections can be intercepted. This includes passwords, session tokens, and personal information.
検出シグナル:
HTTP (not HTTPS) requests containing authentication data or sensitive information
Weak cryptographic storage
Data stored with weak or broken encryption (MD5, SHA1, DES) can be recovered by attackers who gain database access.
検出シグナル:
Database dumps containing hashed passwords with known weak algorithms
予防方法
- Classify data processed, stored, or transmitted by an application
- Don't store sensitive data unnecessarily
- Encrypt all sensitive data at rest
- Use up-to-date and strong standard algorithms and protocols
- Encrypt all data in transit with secure protocols such as TLS
- Disable caching for responses containing sensitive data
- Store passwords using strong salted hashing functions
Shoulder検出付きCWE (8)
これらのCWEにはShoulder検出ルールがあります。クリックして特定の脆弱性と修正を確認してください。
CWE-319
6 ルール
Cleartext Transmission of Sensitive Information
go, kubernetes, yaml, python
CWE-327
4 ルール
Use of a Broken or Risky Cryptographic Algorithm
go, javascript, typescript, python
CWE-338
4 ルール
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
go, javascript, typescript, python
CWE-347
1 致命的
4 ルール
Improper Verification of Cryptographic Signature
python, go, javascript, typescript
CWE-326
2 ルール
Inadequate Encryption Strength
python
CWE-916
2 ルール
Use of Password Hash With Insufficient Computational Effort
javascript, typescript, python
CWE-321
1 致命的
1 ルール
Use of Hard-coded Cryptographic Key
javascript, typescript
CWE-330
1 ルール
Use of Insufficiently Random Values
go
その他のマップされたCWE (22)
これらのCWEはこのカテゴリにマップされていますが、まだShoulderルールがありません。
CWE-261
CWE-261
CWE-296
CWE-296
CWE-310
CWE-310
CWE-322
CWE-322
CWE-323
CWE-323
CWE-324
CWE-324
CWE-325
CWE-325
CWE-328
CWE-328
CWE-329
CWE-329
CWE-331
CWE-331
CWE-335
CWE-335
CWE-336
CWE-336
CWE-337
CWE-337
CWE-339
CWE-339
CWE-340
CWE-340
CWE-523
CWE-523
CWE-720
CWE-720
CWE-757
CWE-757
CWE-759
CWE-759
CWE-760
CWE-760
CWE-780
CWE-780
CWE-818
CWE-818