Read more about this topic in OWASP’s free Cheat Sheets on Cryptographic Storage, and Transport Layer Protection 4 5 6 7 Cryptography Cryptography Cryptography Cryptography Paulo can access data in transit Kyle can bypass cryptographic Romain can read and modify data Gunter can intercept or modify that is not encrypted, even controls because they do not fail in transit (e.g. cryptographic encrypted data in transit because though the channel is encrypted securely (i.e. they default to secrets, credentials, session the protocol is poorly deployed, unprotected) identifiers, personal and or weakly configured, or commercially-sensitive data), in certificates are invalid, or communications within the certificates are not trusted, or the application, or between the connection can be degraded to a application and users, or between weaker or un-encrypted the application and external communication systems 8 9 10 J Cryptography Cryptography Cryptography Cryptography Eoin can access stored business Andy can bypass random number Susanna can break the Justin can read credentials for data (e.g. passwords, session generation, random GUID cryptography in use because it is accessing internal or external identifiers, PII, cardholder data) generation, hashing and not strong enough for the degree resources, services and others because it is not securely encryption functions because of protection required, or it is not systems because they are stored encrypted or securely hashed they have been self-built and/or strong enough for the amount of in an unencrypted format, or are weak effort the attacker is willing to saved in the source code make
Read more about this topic in OWASP’s free Cheat Sheets on Cryptographic Storage, and Transport Layer Protection Cryptography 4 Cryptography 5 Cryptography 6 Cryptography 7 Paulo can access data in transit that is not encrypted, even though the channel is encrypted Kyle can bypass cryptographic controls because they do not fail securely (i.e. they default to unprotected) Romain can read and modify data in transit (e.g. cryptographic secrets, credentials, session identifiers, personal and commercially-sensitive data), in communications within the application, or between the application and users, or between the application and external systems Gunter can intercept or modify encrypted data in transit because the protocol is poorly deployed, or weakly configured, or certificates are invalid, or certificates are not trusted, or the connection can be degraded to a weaker or un-encrypted communication Cryptography 8 Cryptography 9 Cryptography 10 Cryptography J Eoin can access stored business data (e.g. passwords, session identifiers, PII, cardholder data) because it is not securely encrypted or securely hashed Andy can bypass random number generation, random GUID generation, hashing and encryption functions because they have been self-built and/or are weak Susanna can break the cryptography in use because it is not strong enough for the degree of protection required, or it is not strong enough for the amount of effort the attacker is willing to make Justin can read credentials for accessing internal or external resources, services and others systems because they are stored in an unencrypted format, or saved in the source code
20130225125819%21OWASP-Cornucopia-Ecommerce_Website.docx