Sensitive Data Exposure

Overview

Sensitive data exposure is a widespread vulnerability that involves compromising protected data. This can include credentials, credit card numbers, social security numbers, medical information, personally identifiable information (PII), and other personal information. It is crucial for organizations to understand the importance of protecting users' information and comply with privacy laws.

Description

Sensitive data exposure occurs when data that should have been protected is compromised. This vulnerability is commonly exploited and can have severe consequences. For example, an application may encrypt credit card numbers in a database using automatic database encryption, but a flaw like SQL injection can retrieve the credit card numbers in clear text. Another scenario involves a site that doesn't use or enforce TLS for all pages, allowing an attacker to intercept requests and steal a user's session cookie, gaining access to private data.

How to Prevent ?

To prevent sensitive data exposure, it is important to classify data processed, stored, or transmitted by an application. Identify which data is sensitive and apply controls accordingly. Avoid storing sensitive data unnecessarily and discard it as soon as possible. Encrypt all sensitive data at rest and ensure up-to-date and strong encryption algorithms, protocols, and keys are used. Encrypt all data in transit using secure protocols like TLS with perfect forward secrecy (PFS) ciphers. Enforce encryption using directives like HTTP Strict Transport Security (HSTS) and disable caching for responses containing sensitive data. Store passwords using strong adaptive and salted hashing functions, and regularly verify the effectiveness of configuration and settings.

Example Attack Scenarios:

• Example Attack Scenario: C&A Gift Card Cyberattack:  In August 2018, the Brazilian C&A retail fashion chain experienced a cyberattack on their gift card platform. This attack resulted in the exposure of sensitive data, compromising the privacy of their customers.

• Example Attack Scenario: Uber Breach:  In 2016, Uber suffered a breach that exposed the personal information of 57 million users, as well as 600,000 drivers. This breach showcased the consequences of not properly encrypting sensitive data.

• Example Attack Scenario: Target Store Data Breach:  During the Thanksgiving period, Target experienced a data breach that exposed credit/debit card information and contact details of up to 110 million individuals. This breach highlighted the risks of not adequately protecting sensitive data.