Hi, and welcome. Today, we're going to talk about
the second issue, which is, not encrypting
sensitive information. We're going to talk about why encrypting sensitive
information is an issue and some mitigations to prevent these types of issues
in your web application. After this lesson,
you'll be able to explain why encrypting
sensitive information is important and discuss ways to prevent these issues.
Let's get started. When we don't encrypt
sensitive information or we don't know
what information is sensitive, so we don't end up
encrypting that information. What can happen is, for example, if you're dealing
with sensitive data in transit, you could have, for example, regular
HTTP traffic that can be watched by an attacker
who is on the same network. Another example is
for data at rest. An attacker can obtain data from the web
applications database, for example, where
that data is not encrypted, and steal that data very easily. Now, with the second example, you would end up having
other mitigations to make sure that the web
applications database is not easily accessible. So this type of
example is a little bit more difficult,
relatively speaking. But sometimes, these can happen. So some general prevention
strategies are the following. Fundamentally speaking,
we want to make sure we know what kinds of data that our web application deals with. We categorize our data based
on their sensitivity levels. Now, OWASP has a really
good track on this on their website to categorize data based on how sensitive
the data is. We also want to
determine what data goes out in transit and
what data is at rest. Another fundamental prevention
strategy that you can make is to not store or handle
data unless you need to. So for example,
credit card numbers. What you can do, and this is a PCI DSS compliance technique, is to tokenize the PAN of
a credit card, for example. Another prevention strategy
that you can make is to make sure you understand and use a standard cryptography measures
that exist today. As of the date of
the creation of these slides, we would use AES block cipher
in CBC mode with random IV. So in summary, we talked
about the second issue of not encrypting
sensitive information, and we talked about
some fundamental mitigations that you could make in order to make sure
that you minimize the impact of this issue. That's it for now.
Thanks for listening.