Write Code That Protects Sensitive User Data – Security Boulevard

Sensitive data exposure is currently at number 3 in the??OWASP Top 10??list of the most critical application security risks.

In this blog post, we will describe common scenarios of incorrect sensitive data handling and suggest ways to protect sensitive data. We will illustrate our suggestions with code samples in C# that can be used in ASP.NET Core applications.

OWASP lists passwords, credit card numbers, health records, personal information and business secrets as sensitive data.

Social security numbers, passwords, biometric data, trade memberships and criminal records can also be thought of at sensitive data.

What exactly sensitive data means for you will depend on:

In software applications, we can think of sensitive data as:

Various sources and authorities may have different definitions of sensitive data. However, if youre a business that develops an application that works with user data, its in your best interest to use a broad interpretation of sensitive data and do your best to protect it.

Lets discuss some of the most common vulnerabilities that can expose sensitive user data.

Due to inadequate access control, users who are not expected to see sensitive data may in fact be able to access it, even though the data is not referenced by the application in any way. An attack called force browsing takes advantage of this situation.

Imagine youre a regular user of a web application, and when you look around the UI, you dont see any administrative functionality available. Still, if you manually enter a URL that you think may be available to admin users (such as??https://www.myapp.com/admin), you do see the admin UI. This is forced browsing: the application didnt guide you to a restricted resource, but neither did it prevent you from accessing it.

Improperly managed sessions

When sessions are managed improperly, session IDs of authenticated users are at risk of being exposed, and attackers can take advantage of this to impersonate legitimate users. Two common attacks that are made possible by improper session management are session hijacking and session fixation. Attacks like these can have a severe impact if targeted at privileged accounts and can cause massive leakage of sensitive data.

One major reason why sessions can be mismanaged is that developers sometimes write their custom authentication and session management schemes instead of using battlefield-tested solutions, but doing this correctly is hard.

Insecure cryptographic storage??refers to unsafe practices of storing sensitive data, most prominently user passwords. This is not about not protecting data at all, which results in storing passwords as plain text. Instead, this is about applying a wrong cryptographic process or a surrogate, such as:

This vulnerability is extra important because secure cryptographic storage is the last line of defense: strong cryptography saves the data once it has been exposed by other risks in an application.

Lets see what kind of??secure coding practices??can help you avoid vulnerabilities such as the ones listed above, and minimize the risk of disclosing sensitive data.

This is a hidden page!

However, if the??Home??controllers??Hidden??action is not configured as available to logged-in users only, an anonymous user would still be available to enter the direct URL and access the hidden page. To prevent this, the controller action should be protected as well:

Weve learned how applying a set of secure coding practices in access control, session management and cryptographic storage can help you avoid a set of vulnerabilities and minimize the risk of disclosing sensitive data.

Theres one more fundamental advice that OWASP gives:??dont store sensitive data unless you absolutely need to. Data that is not stored cannot be compromised.

Whatever decisions you make on data storage policy, remember to detect vulnerable code early with continuous testing, code review, static and dynamic analysis.

*** This is a Security Bloggers Network syndicated blog from Application Security Research, News, and Education Blog authored by jlane@veracode.com (jlane). Read the original post at: https://www.veracode.com/blog/secure-development/write-code-protects-sensitive-user-data

See more here:
Write Code That Protects Sensitive User Data - Security Boulevard