#2
A02:2021
Cryptographic Failures
Failures related to cryptography which often lead to sensitive data exposure. This was previously known as Sensitive Data Exposure.
개요
Shifting up one position to #2, previously known as Sensitive Data Exposure. The focus is on failures related to cryptography which often leads to sensitive data exposure or system compromise.
공격자가 이것을 악용하는 방법
공격 패턴을 이해하면 더 나은 방어를 구축하는 데 도움이 됩니다. 이것들은 보안 팀이 주시하는 기술입니다.
Data exposure in transit
Sensitive data transmitted over unencrypted connections can be intercepted. This includes passwords, session tokens, and personal information.
탐지 신호:
HTTP (not HTTPS) requests containing authentication data or sensitive information
Weak cryptographic storage
Data stored with weak or broken encryption (MD5, SHA1, DES) can be recovered by attackers who gain database access.
탐지 신호:
Database dumps containing hashed passwords with known weak algorithms
예방 방법
- Classify data processed, stored, or transmitted by an application
- Don't store sensitive data unnecessarily
- Encrypt all sensitive data at rest
- Use up-to-date and strong standard algorithms and protocols
- Encrypt all data in transit with secure protocols such as TLS
- Disable caching for responses containing sensitive data
- Store passwords using strong salted hashing functions
Shoulder 탐지가 있는 CWE (8)
이 CWE들은 Shoulder 탐지 규칙이 있습니다. 클릭하여 특정 취약점과 수정 사항을 확인하세요.
CWE-319
6 규칙
Cleartext Transmission of Sensitive Information
go, kubernetes, yaml, python
CWE-327
4 규칙
Use of a Broken or Risky Cryptographic Algorithm
go, javascript, typescript, python
CWE-338
4 규칙
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
go, javascript, typescript, python
CWE-347
1 치명적
4 규칙
Improper Verification of Cryptographic Signature
python, go, javascript, typescript
CWE-326
2 규칙
Inadequate Encryption Strength
python
CWE-916
2 규칙
Use of Password Hash With Insufficient Computational Effort
javascript, typescript, python
CWE-321
1 치명적
1 규칙
Use of Hard-coded Cryptographic Key
javascript, typescript
CWE-330
1 규칙
Use of Insufficiently Random Values
go
기타 매핑된 CWE (22)
이 CWE들은 이 카테고리에 매핑되어 있지만 아직 Shoulder 규칙이 없습니다.
CWE-261
CWE-261
CWE-296
CWE-296
CWE-310
CWE-310
CWE-322
CWE-322
CWE-323
CWE-323
CWE-324
CWE-324
CWE-325
CWE-325
CWE-328
CWE-328
CWE-329
CWE-329
CWE-331
CWE-331
CWE-335
CWE-335
CWE-336
CWE-336
CWE-337
CWE-337
CWE-339
CWE-339
CWE-340
CWE-340
CWE-523
CWE-523
CWE-720
CWE-720
CWE-757
CWE-757
CWE-759
CWE-759
CWE-760
CWE-760
CWE-780
CWE-780
CWE-818
CWE-818