Difference between revisions of "OWASP Periodic Table of Vulnerabilities - Insufficient Data Protection"

From OWASP
Jump to: navigation, search
(initial page setup)
 
m
Line 4: Line 4:
  
 
=== Root Cause Summary ===
 
=== Root Cause Summary ===
 
+
Sensitive data is not sufficiently protected against disclosure, modification or non-repudiation.
  
 
=== Browser / Standards Solution ===
 
=== Browser / Standards Solution ===
 
None
 
  
 
=== Perimeter Solution ===
 
=== Perimeter Solution ===
Line 24: Line 22:
 
=== Custom Code Solution ===
 
=== Custom Code Solution ===
  
None
+
Identify which kinds of data need to be protected, for example Personally Identifiable Information (PII) or authentication and identification data.
  
 
=== Discussion / Controversy ===
 
=== Discussion / Controversy ===
 
+
Data protection laws vary from country to country. Ensure that the correct mitigations and protections have been taken.
 +
US data protection law
  
  
 
=== References ===
 
=== References ===
 +
[http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:NOT Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (European Union)]<br>

Revision as of 04:35, 20 May 2013

Return to Periodic Table Working View

Contents

Insufficient Data Protection

Root Cause Summary

Sensitive data is not sufficiently protected against disclosure, modification or non-repudiation.

Browser / Standards Solution

Perimeter Solution

None

Generic Framework Solution

Provide a configuration-based suite of encryption utilities for all data security needs including HMAC, symmetric, password hash, and asymmetric encryption requirements.

Custom Framework Solution

None

Custom Code Solution

Identify which kinds of data need to be protected, for example Personally Identifiable Information (PII) or authentication and identification data.

Discussion / Controversy

Data protection laws vary from country to country. Ensure that the correct mitigations and protections have been taken. US data protection law


References

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (European Union)