sensitive-data-protection

Sensitive Data Protection (OWASP A03)

Protect sensitive data in transit and at rest through proper encryption, masking, and access controls.

When to Use

• Handling user personal information (PII)
• Storing or transmitting passwords
• Processing payment card data
• Managing API keys and secrets
• Implementing data encryption
• Ensuring compliance (GDPR, PCI-DSS, HIPAA)

Sensitive Data Categories

Category	Examples	Protection Level
Credentials	Passwords, API keys, tokens	CRITICAL
Financial	Credit cards, bank accounts	CRITICAL
Personal (PII)	SSN, passport, driver's license	HIGH
Health (PHI)	Medical records, prescriptions	HIGH
Contact	Email, phone, address	MEDIUM
Behavioral	Browsing history, preferences	MEDIUM

Detection Patterns

Exposed Sensitive Data

// VULNERABLE - Logging sensitive data
console.log('User login:', { email, password });
logger.info(`Payment processed: ${creditCardNumber}`);

// VULNERABLE - Sensitive data in URL
res.redirect(`/reset?token=${token}&email=${email}`);

// VULNERABLE - Sensitive data in error messages
throw new Error(`Invalid password for user ${email}`);

// VULNERABLE - Storing unencrypted
user.ssn = req.body.ssn;
user.creditCard = req.body.cardNumber;

Weak Encryption

// VULNERABLE - Weak algorithms
const encrypted = crypto.createCipher('des', key); // DES is broken
const hash = crypto.createHash('md5').update(data); // MD5 is broken

// VULNERABLE - ECB mode
crypto.createCipheriv('aes-256-ecb', key, ''); // ECB leaks patterns

// VULNERABLE - Hardcoded keys
const ENCRYPTION_KEY = 'my-secret-key-123';

// VULNERABLE - Predictable IV
const iv = Buffer.alloc(16, 0); // All zeros IV

Secure Implementation

1. Encryption at Rest

const crypto = require('crypto');

const ALGORITHM = 'aes-256-gcm';
const KEY = Buffer.from(process.env.ENCRYPTION_KEY, 'hex'); // 256-bit key

function encrypt(plaintext) {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv(ALGORITHM, KEY, iv);

  let encrypted = cipher.update(plaintext, 'utf8', 'hex');
  encrypted += cipher.final('hex');

  const authTag = cipher.getAuthTag();

  // Return IV + AuthTag + Ciphertext
  return iv.toString('hex') + ':' + authTag.toString('hex') + ':' + encrypted;
}

function decrypt(encryptedData) {
  const [ivHex, authTagHex, ciphertext] = encryptedData.split(':');

  const iv = Buffer.from(ivHex, 'hex');
  const authTag = Buffer.from(authTagHex, 'hex');

  const decipher = crypto.createDecipheriv(ALGORITHM, KEY, iv);
  decipher.setAuthTag(authTag);

  let decrypted = decipher.update(ciphertext, 'hex', 'utf8');
  decrypted += decipher.final('utf8');

  return decrypted;
}

// Usage
user.encryptedSSN = encrypt(ssn);
const ssn = decrypt(user.encryptedSSN);