2021 OWASP Top Ten: Cryptographic Failures

Shifting up one position from the 2017 list to Number 2 is Cryptographic Failures. This was previously known as "Sensitive Data Exposure" which is more of a broad symptom rather than a root cause, and the focus is on failures related to cryptography (or lack thereof). This can often lead to exposure of sensitive data. Notable Common Weakness Enumerations (CWEs) included are CWE-259: Use of Hard-coded Password, CWE-327: Broken or Risky Crypto Algorithm, and CWE-331 Insufficient Entropy. #OWASPTOP10
Video 3/11
⬇️⬇️⬇️ JOIN THE COMMUNITY! ⬇️⬇️⬇️
DevCentral is an online community of technical peers dedicated to learning, exchanging ideas, and solving problems - together.
Find all our platform links ⬇️ and follow our Community Evangelists! 👋
➡️ DEVCENTRAL: community.f5.com
➡️ TH-cam: / devcentral
➡️ LINKEDIN: / f5-devcentral
➡️ TWITTER: / devcentral
Your Community Evangelists:
👋 Jason Rahm: / jrahm | / jasonrahm
👋 Buu Lam: / buulam | / buulam
👋 Aubrey King: / aubreyking | / aubreykingf5

[@ruthfehilly8640]

Really really good videos. Quick and to the point

[@devcentral]

Thanks Ruth! Glad you enjoyed them and we appreciate the comment!!

[@EasyPickens999]

Hi, first of all many thanks for the videos. In your first example you mention to avoid auto-decryption. Do you mean between the DB and the app? In the case of a user querying CC numbers, you would eventually need to decrypt, would this be done in the app?

[@covfefe2936]

Amazing video!! Love this straight forward format easy to remember

[@devcentral]

Thanks for the comment and glad you enjoyed the video!!

[@skselim8536]

Awesome 🌟

[@devcentral]

Glad you liked it and thanks for the comment!

[@BhargavRajaram]

These guys have just narrated what's there on OWASP website.

[@hammasahmed5592]

Failure, I was expecting a failure in the algorithm that would lead to data exposure, not a failure in cryptographic setup.
The good point its the downgrade attack, if it's possible to downgrade a version of cryptos, this would actually be a failure.

[@seyedmohammadmortezasanaie8346]

Your explanation was very bad. This beautiful type of attack could have much better examples 👎