← Web Application Security (OWASP) learning pathWeb Application Security (OWASP) · Module 6 of 10
Cryptographic failures and sensitive data
Protect data in transit and at rest.
📖 Key ideas
- Use HTTPS (TLS 1.2+) everywhere.
- Encrypt sensitive data at rest; manage keys in a KMS.
- Do not invent your own cryptography; use vetted libraries.
- Collect and keep only the data you need.
- Never log passwords, OTPs or card numbers.
💡 Real-life example: Sensitive data is cash: carry it in a locked bag (encryption), and don't carry more than needed.
TLSEncrypts data in transit
Encryption at restEncrypting stored data
KMSKey management service
Data minimisationCollecting only necessary data