Insights
Practical guidance for protecting sensitive data
Start with your discovery, access analysis, or runtime protection project. The article library below covers cryptography, data exposure, and practical protection guidance.
Explore guidance by product
Use the product pages for capabilities and evaluation questions. Read the technical articles below for encryption, key management, and application security guidance.
Sensitive Data Discovery & Classification
Explore source inventory, sensitive-data classification, scan coverage, and the findings to review in a DSPM evaluation.
Access Intelligence
Explore effective permissions, human and non-human identities, granting paths, and the evidence to review in an ISPM project.
Runtime Data Protection
Explore identity-based masking, tokenization, and encryption. Compare runtime protection options using the links in Resources.
-
The Advantages of Library-Based Architectures Over Proxies
Organizations looking to secure sensitive data must balance performance, cost, and security when choosing an encryption, tokenization, and masking solution. While proxy/gateway models may appear simple on the surface, they introduce latency, infrastructure costs, operational complexity, and security
Read article → -
Evolving FS-ISAC Encryption Standards: Embracing Zero Trust Data Security
This blog advocates for an updated approach that aligns with Zero Trust data security principles. We propose a shift towards file- and record-level encryption, coupled with identity-driven, data-level security controls, to provide financial institutions with more comprehensive protection against mod
Read article → -
Exploring CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
The OWASP Top Ten list is a preeminent resource for application security. It describes the ten most common and impactful vulnerabilities that affect web applications today. In the latest version of the OWASP Top Ten list, Cryptographic Failures took the number two spot. This vulnerability describes
Read article → -
Ubiq Achieves SOC 2 Type II Compliance
We’re thrilled to announce that we’re SOC 2 Type II compliant! Security and privacy are at the core of everything we do at Ubiq – so it shouldn’t surprise you that we built a product that, by design, helps you protect your sensitive data. Since our early days, we’ve worked with expert se
Read article → -
Exploring CWE-331: Insufficient Entropy
Introduction Application security is critical to prevent cyber attacks. The OWASP Top Ten list is a well-known resource that identifies the most common and dangerous vulnerabilities in web applications and software. One of the vulnerabilities in the OWASP Top Ten is Cryptographic Failures, which inc
Read article → -
Data at Rest Encryption: A False Sense of Security
Complexity in modern cryptography comes down to key management. Cryptographic algorithms and protocols are designed to be open, so the only secrets are the keys used. If the keys are accidentally exposed to unintended parties, then the protected data is also exposed. If the keys are lost, then the d
Read article → -
Exploring CWE-330 Use of Insufficiently Random Values
The OWASP Top 10 list provides in-depth information about the most common security issues facing web applications. Number two on the list is A02:2021 – Cryptographic Failures, which covers a wide range of common mistakes. Among this list of cryptographic failures is the use of insufficiently random
Read article → -
Exploring CWE-329 Generation of Predictable IV with CBC Mode
The OWASP Top Ten list provides in-depth information about the most common security issues facing web applications. Number two on the list is A02:2021 – Cryptographic Failures, which covers a wide range of common mistakes. One of these cryptographic failures is CWE 329, which discusses the generatio
Read article → -
Exploring CWE-328 Use of a Weak Hash
The OWASP Top Ten list provides in-depth information about the most common security issues facing web applications. Number two on the list is A02:2021 – Cryptographic Failures , which covers a wide range of common mistakes. Included in the list of CWEs related to this vulnerability is CWE 328 , Use
Read article → -
Exploring CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Introduction The OWASP Top Ten list provides in-depth information about the most common security issues facing web applications. Number two on the list is A02:2021 – Cryptographic Failures, which covers a wide range of common mistakes. When selecting a cryptographic algorithm for use in an applicati
Read article → -
Exploring CWE-326 Inadequate Encryption Strength
Introduction The OWASP Top Ten list provides in-depth information about the most common security issues facing web applications. Number two on the list is A02:2021 – Cryptographic Failures, which covers a wide range of common mistakes. When implementing cryptographic functionality in their code, dev
Read article → -
Exploring CWE-325: Missing Cryptographic Step
Introduction The OWASP Top Ten list provides in-depth information about the most common security issues facing web applications. Number two on the list is A02:2021 – Cryptographic Failures, which covers a wide range of common mistakes. Cryptographic algorithms and protocols are carefully designed pr
Read article → -
Exploring CWE-324: Use of a Key Past its Expiration Date
Introduction The OWASP Top Ten list provides in-depth information about the most common security issues facing web applications. Number two on the list is A02:2021 – Cryptographic Failures, which covers a wide range of common mistakes. Key expiration is designed to mitigate the probability and impac
Read article → -
Exploring CWE-323 Reusing a Nonce, Key Pair in Encryption
Introduction The OWASP Top Ten list provides in-depth information about the most common security issues facing web applications. Number two on the list is A02:2021 – Cryptographic Failures, which covers a wide range of common mistakes. Among these mistakes is the reuse of nonces when sending encrypt
Read article → -
What Is Format-Preserving Encryption and What Are Its Benefits?
Format-preserving encryption protects values while keeping their original length and character set. Learn where FPE fits, its limitations, and current NIST guidance.
Read article → -
Exploring CWE-322: Key Exchange without Entity Authentication
Introduction A02:2021 – Cryptographic Failures is the second most common vulnerability on OWASP’s Top Ten List of web application vulnerabilities. Strong encryption is a fundamental component of data security and privacy, but it is easy to get wrong. Errors in data encryption can undermine or destro
Read article → -
Exploring CWE-321: Use of Hard-coded Cryptographic Key
Introduction A02:2021 – Cryptographic Failures is the second most common vulnerability on OWASP’s Top Ten List of web application vulnerabilities. Strong encryption is a fundamental component of data security and privacy, but it is easy to get wrong. Errors in data encryption can undermine or destro
Read article → -
Exploring CWE-319: Cleartext Transmission of Sensitive Information
Introduction A02:2021 – Cryptographic Failures is the second most common vulnerability on OWASP’s Top Ten List of web application vulnerabilities. Strong encryption is a fundamental component of data security and privacy, but it is easy to get wrong. Errors in data encryption can undermine or destro
Read article → -
Securing Financial Institutions: Emergence of Open Banking
The authors’ views are their own and do not represent the official position of the S. Rajaratnam School of International Studies, NTU. These commentaries may be reproduced with prior permission from RSIS and due recognition to the author(s) and RSIS. Please email to Mr Yang Razali Kassim, Editor RSI
Read article → -
Exploring CWE-296: Improper Following of a Certificate’s Chain of Trust
Public Key Infrastructure (PKI) ties public keys to identities via digital certificates, but this doesn’t always work out.
Read article → -
Exploring CWE-261: Weak Encoding for Password
Writer’s comment: This blog is the third in a multi-part series focused on OWASP’s A02:2021 – Cryptographic Failures vulnerability and most of the 29 associated Common Weakness Enumeration (CWE). Introduction Passwords are some of the most commonly used authentication mechanisms. To authenticate to
Read article → -
Practical Guidance for Preventing OWASP Cryptographic Failures
A practical checklist for preventing OWASP Cryptographic Failures across data classification, retention, encryption, key management, randomness, password storage, and verification.
Read article → -
New OWASP Top 10 List Places Focus on Cryptographic Failures
The OWASP Top 10 List is an invaluable resource for web developers, providing insight into the most common and dangerous vulnerabilities found in production web applications. The list is updated about every three years, and the latest update was released in late 2021. The release featured a number o
Read article → -
ECB vs. CBC: Differences Between These Block Cipher Modes
ECB exposes plaintext patterns, while CBC hides repeated blocks but does not authenticate ciphertext. Learn why modern systems should prefer an authenticated encryption mode.
Read article → -
5 Ways to Overcome the Challenges of Implementing Cryptography in Java
Cryptographic functionality is essential to a massive number of applications. As data protection regulations mandate how certain types of data should be protected, developers are increasingly required to build cryptography into their code. Java is currently one of the most popular programming
Read article → -
Overcoming the Challenges of Implementing Cryptography in Python
Cryptography can go wrong in a number of ways. We highlight some of the challenges Python developers face when building cryptography into their code.
Read article → -
3 Common Encryption Mistakes That Are Easy to Avoid
Learn about three common encryption mistakes that developers make that can cause security vulnerabilities and how easily they can be resolved.
Read article → -
128 or 256 bit Encryption: Which Should I Use?
AES-128 and AES-256 are both approved and secure when implemented correctly. Learn when 128-bit encryption is sufficient and when 256-bit encryption is the better choice.
Read article → -
Bouncy Castle and the Impact of Cryptographic Vulnerabilities
Learn about the potential damage caused by the Bouncy Castle vulnerability because of the location of the vulnerability in the library.
Read article → -
Authenticated Encryption: An Explainer
Authenticated encryption protects confidentiality and detects unauthorized modification. Learn how AEAD modes, authentication tags, nonces, and associated data work.
Read article → -
5 Common Key Management Challenges
Five recurring enterprise key-management challenges: security, lifecycle complexity, availability, heterogeneous systems, and governance.
Read article → -
Zerologon: Why You Should Never “Roll Your Own” Cryptography
The recent Zerologon vulnerability demonstrated the importance of never ‘rolling your own cryptography’, and this blog piece explains why.
Read article → -
Capital One Breach Lessons for Protecting Sensitive Data
The 2019 Capital One incident shows why least privilege, cloud configuration, field-level protection, and authorization boundaries must work together.
Read article →