Skip to content

SCP [198, 201, 143, 144, 145, 146, 147, 148, 150] Cornucopia - Data Protection #130

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jul 4, 2025
+17 −0
Merged

SCP [198, 201, 143, 144, 145, 146, 147, 148, 150] Cornucopia - Data Protection #130

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
dfcfe14
Fixes #129 SCP [198, 201, 143, 144, 145, 146, 147, 148, 150] Cornucop…
sydseter Jul 3, 2025
3922805
Fixes #129 SCP [198, 201, 143, 144, 145, 146, 147, 148, 150] Cornucop…
sydseter Jul 3, 2025
4fd31d9
Fixes #129 remove mobile references
sydseter Jul 4, 2025
fa08b08
Merge branch 'main' into 08-protect-data
sydseter Jul 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .wordlist-en.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -536,3 +536,7 @@ BOLA
WebDAV
tunable
allowlist
printf
strcat
strcpy
unencrypted
13 changes: 13 additions & 0 deletions docs/en/04-design/02-web-app-checklist/08-protect-data.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@ and use the list below as suggestions for a checklist that has been tailored for
12. Purge those temporary copies of sensitive data as soon as they are no longer required
13. Do not include sensitive information in the URL or query string, such as an API key or session token
14. Disable client side caching on pages containing sensitive information (e.g. Cache-Control: no-store)
15. Set a referrer policy to prevent leakage of sensitive data to third-party services via the 'Referer' HTTP request header
field. This can be done using the Referrer-Policy HTTP response header field or via HTML element attributes

#### 2. Memory management

Expand All @@ -33,11 +35,21 @@ and use the list below as suggestions for a checklist that has been tailored for
6. Properly free allocated memory upon the completion of functions and at all exit points
7. Overwrite any sensitive information stored in allocated memory at all exit points from the function
8. Protect shared variables and resources from inappropriate concurrent access
9. Avoid the use of known vulnerable functions (e.g., printf, strcat, strcpy etc.)

#### 3. Encrypting Data in Transit

1. Utilize TLS connections for all connectivity between a client and external-facing, HTTP-based services
2. Ensure the TLS connections do not fall back to insecure or unencrypted communication
3. Utilize a single standard TLS implementation with (preferably the latest) secure version of TLS
4. Ensure the TLS connections are configured appropriately to validate certificates received before communicating and
checking revocation status

#### References

* OWASP [Cheat Sheet: Cryptographic Storage][cscs]
* OWASP [Cheat Sheet: Secrets Management][cssm]
* OWASP [Cheat Sheet: Transport Layer Security][cstls]
* OWASP [Top 10 Proactive Controls][proactive10]

----
Expand All @@ -49,6 +61,7 @@ then [submit an issue][issue060208] or [edit on GitHub][edit060208].
[control2]: https://top10proactive.owasp.org/the-top-10/c2-crypto/
[cscs]: https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet
[cssm]: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet
[cstls]: https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html
[edit060208]: https://github.com/OWASP/DevGuide/blob/main/docs/en/04-design/02-web-app-checklist/08-protect-data.md
[issue060208]: https://github.com/OWASP/DevGuide/issues/new?labels=enhancement&template=request.md&title=Update:%2004-design/02-web-app-checklist/08-protect-data
[proactive10]: https://top10proactive.owasp.org/