Instructor: Sensitive Data Exposure. 2 2
In this lesson, we're going to talk 3 3
about sensitive data exposure, 4 4
which is when a software vulnerability occurs 5 5
that allows the attacker to be able 6 6
to circumvent access controls 7 7
and retrieve confidential or sensitive data 8 8
from a file system or a database. 9 9
Essentially, we're having a breach of confidentiality here 10 10
so we want to make sure we don't have this happen. 11 11
So how can we end up preventing sensitive data exposure? 12 12
Well, we should program our web applications 13 13
to only send data between authenticated hosts 14 14
using cryptography and encryption to protect the session. 15 15
Now, when it comes to encryption, what type should you use? 16 16
Should you use your own encryption mechanism? 17 17
Should you make something up because you're just that smart? 18 18
No, you should use what everybody else is using. 19 19
You should be using AES. 20 20
You should be using other things 21 21
that are widely known and widely tested 22 22
because those have been proven to be secure. 23 23
As smart as you may think you are, 24 24
using your own encryption scheme is a recipe for disaster 25 25
because our own encryption schemes aren't tested 26 26
to the level that AES and other worldwide standards are. 27 27
So we should really be using those worldwide standards 28 28
as a best practice whenever we're using encryption. 29 29
Now, another thing you need to avoid 30 30
inside of your applications is the use 31 31
of hardcoded credentials. 32 32
This means you don't want to be able to put in things 33 33
like your database credentials inside your web app 34 34
or your usernames or your passwords or things like that. 35 35
If you're typing them in plain text and hardcoding them in, 36 36
even as a hash, that is something that could be taken 37 37
and exploited against you. 38 38
And this would be another thing that leads 39 39
to sensitive data exposure. 40 40
Another thing we always want to make sure we do 41 41
is disable the use of client password autocomplete features, 42 42
temporary files and cookies whenever possible. 43 43
By doing this, we can reduce the risk 44 44
of sensitive data exposure. 45 45
Now, speaking of cookies, one more time, 46 46
let's talk about cookies. 47 47
There are five key areas inside of your cookies 48 48
that you need to think about because these five areas 49 49
and these five attributes are things 50 50
that may offer client protection 51 51
depending on how you set them up. 52 52
First, we have secure. 53 53
When we talk about the secure attribute, 54 54
this instructs the client's web browser 55 55
to only send the cookie if it's being sent 56 56
over a secure channel like https. 57 57
Basically, it requires encryption 58 58
for you to be able to pass the cookie. 59 59
Second, HttpOnly. 60 60
This prevents attacks such as cross-site scripting 61 61
because it disables access from client-side scripting 62 62
to your cookie. 63 63
The only way you can access the cookie 64 64
is over http. 65 65
Third, domain. 66 66
This is going to set the domain of the server 67 67
that the cookie is valid for. 68 68
Cookies are only going to be able to be accessed 69 69
from the domain or subdomains specified 70 70
within this particular attribute 71 71
so it really limits who can access that cookie. 72 72
Fourth, path. 73 73
This is going to specify the URL path 74 74
for which the cookie is valid. 75 75
Now, this may be the domain 76 76
but it also might be a sub-part of the domain. 77 77
For instance, you might have a cookie for diontrain.com, 78 78
or it might be set to the path 79 79
of diontrain.com/account/course/cysa 80 80
or something like that. 81 81
And fifth, expires. 82 82
This is used to set persistent cookies that will expire 83 83
at a certain date within this attribute. 84 84
So I might set my cookie to expire after seven days, 85 85
30 days, 60 days, a year, whatever it is. 86 86
Just remember, the longer that you keep this, 87 87
the more chance there is the data inside that cookie 88 88
could be accessed.