In this series of articles, we take you through the OWASP Top 10 — the ten most common, and most damaging, categories of cyber attack. There is still plenty of confusion about how these techniques actually work and what you can do about them, and the explanations you find online are often written for specialists rather than the rest of us. At Rootsec, we want to change that, with clear explanations and no avalanche of jargon. In this instalment, we tackle the question: what is sensitive data exposure?
A quick note on naming. This topic appeared in the OWASP Top 10 (2017) as A3: Sensitive Data Exposure. In the current OWASP Top 10 (2021) it has been renamed A02: Cryptographic Failures and moved up to second place. The new name is more precise: “sensitive data exposure” describes the symptom — data ending up in the wrong hands — while the real root cause is usually a failure in cryptography or data protection, such as missing encryption, weak algorithms, or data sent in the clear. We will use both terms in this article, because you will still see “sensitive data exposure” used widely.
What is sensitive data exposure?
Sensitive data is everywhere these days. Almost every organisation handles information that matters — login credentials, medical records, financial figures, customer details, and much more. The core problem is the exposure: how does so much valuable data end up at risk, despite how important it is?
Unlike broken authentication, where attackers misuse login credentials directly, sensitive data exposure tends to work indirectly. A common example is a man-in-the-middle attack, where a third party — the attacker — quietly intercepts data as it travels between two parties who think they are talking to each other privately.
These attacks happen wherever large amounts of data are sent without being properly protected. Think of plain HTTP or FTP connections, or worse still, data stored or transmitted in plain text, which an attacker does not even need to decrypt. Older databases that protect passwords with simple, outdated hashing are vulnerable too. A hash is meant to scramble information into a jumble of numbers, letters, and symbols so it can be stored or sent safely — but a weak hash can be cracked, and then that protection counts for nothing.
The consequences of sensitive data exposure
How serious the fallout is depends on how sensitive the data being handled is. For a bank or another financial institution, an incident can lead to significant legal claims and regulatory consequences. For a marketing agency, the biggest cost is often reputational damage — customers simply lose trust. Either way, once data is exposed, the harm can be difficult and expensive to undo.
How to protect against sensitive data exposure
The good news is that protecting sensitive data comes down to a few clear steps:
- Data classification. Start by working out exactly what data flows through your organisation and how sensitive each type is. You cannot protect what you have not mapped, and not all data needs the same level of protection.
- Encryption. This is your primary line of defence, and it is exactly where the modern name — cryptographic failures — comes from. When all your data is strongly encrypted, both in transit and at rest, an attacker who manages to intercept or steal it walks away with nothing usable. Use up-to-date algorithms and protocols (for example, HTTPS everywhere instead of plain HTTP), and avoid the weak, outdated ones.
- Minimal data storage. Only keep the data you genuinely need, for as long as you genuinely need it. Data you never collected, or have safely deleted, can never be exposed.
Get those three right and you have closed off the vast majority of the risk. The hard part, in practice, is knowing whether your applications and systems actually hold up — which is where independent testing comes in. A Rootsec penetration test or security assessment checks where sensitive data is exposed or weakly protected, before an attacker finds it for you.
At Rootsec, it has always been our goal to make information security simple — and this series is part of that mission.
Worried your data might be exposed? Let Rootsec find the gaps before attackers do. Book a free consultation.
