Security Frame: Sensitive Data | Mitigations

Ensure that binaries are obfuscated if they contain sensitive information

Consider using Encrypted File System (EFS) is used to protect confidential user-specific data

Ensure that sensitive data stored by the application on the file system is encrypted

Ensure that sensitive content is not cached on the browser

Example

<configuration>
  <system.webServer>
   <httpProtocol>
    <customHeaders>
        <add name="Cache-Control" value="no-store" />
        <add name="Pragma" value="no-cache" />
        <add name="Expires" value="-1" />
    </customHeaders>
  </httpProtocol>
 </system.webServer>
</configuration>

Example

This may be implemented through a filter. Following example may be used:

public override void OnActionExecuting(ActionExecutingContext filterContext)
        {
            if (filterContext == null || (filterContext.HttpContext != null && filterContext.HttpContext.Response != null && filterContext.HttpContext.Response.IsRequestBeingRedirected))
            {
                //// Since this is MVC pipeline, this should never be null.
                return;
            }

            var attributes = filterContext.ActionDescriptor.GetCustomAttributes(typeof(System.Web.Mvc.OutputCacheAttribute), false);
            if (attributes == null || **Attributes**.Count() == 0)
            {
                filterContext.HttpContext.Response.Cache.SetNoStore();
                filterContext.HttpContext.Response.Cache.SetCacheability(HttpCacheability.NoCache);
                filterContext.HttpContext.Response.Cache.SetExpires(DateTime.UtcNow.AddHours(-1));
                if (!filterContext.IsChildAction)
                {
                    filterContext.HttpContext.Response.AppendHeader("Pragma", "no-cache");
                }
            }

            base.OnActionExecuting(filterContext);
        }

Encrypt sections of Web App's configuration files that contain sensitive data

Explicitly disable the autocomplete HTML attribute in sensitive forms and inputs

Example

<form action="Login.aspx" method="post " autocomplete="off" >
      Social Security Number: <input type="text" name="ssn" />
      <input type="submit" value="Submit" />    
</form>

Ensure that sensitive data displayed on the user screen is masked

Implement dynamic data masking to limit sensitive data exposure non privileged users

Ensure that passwords are stored in salted hash format

Ensure that sensitive data in database columns is encrypted

Ensure that database-level encryption (TDE) is enabled

Ensure that database backups are encrypted

Ensure that sensitive data relevant to Web API is not stored in browser's storage

Example

The below JavaScript snippet is from a custom authentication library which stores authentication artifacts in local storage. Such implementations should be avoided.

ns.AuthHelper.Authenticate = function () {
window.config = {
instance: 'https://login.partner.microsoftonline.cn/',
tenant: ns.Configurations.Tenant,
clientId: ns.Configurations.AADApplicationClientID,
postLogoutRedirectUri: window.location.origin,
cacheLocation: 'localStorage', // enable this for Internet Explorer, as sessionStorage does not work for localhost.
};

Encrypt sensitive data stored in Azure Cosmos DB

Use Azure Disk Encryption to encrypt disks used by Virtual Machines

Encrypt secrets in Service Fabric applications

Perform security modeling and use Business Units/Teams where required

Minimize access to share feature on critical entities

Train users on the risks associated with the Dynamics CRM Share feature and good security practices

Include a development standards rule proscribing showing config details in exception management

Use Azure Storage Service Encryption (SSE) for Data at Rest (Preview)

Use Client-Side Encryption to store sensitive data in Azure Storage

Encrypt sensitive or PII data written to phones local storage

Example

Intune can be configured with following security policies to safeguard sensitive data:

Require encryption on mobile device    
Require encryption on storage cards
Allow screen capture

Example

If the application isn't an enterprise application, then use platform provided keystore, keychains to store encryption keys, using which cryptographic operation may be performed on the file system. Following code snippet shows how to access key from keychain using .NET for iOS:

        protected static string EncryptionKey
        {
            get
            {
                if (String.IsNullOrEmpty(_Key))
                {
                    var query = new SecRecord(SecKind.GenericPassword);
                    query.Service = NSBundle.MainBundle.BundleIdentifier;
                    query.Account = "UniqueID";

                    NSData uniqueId = SecKeyChain.QueryAsData(query);
                    if (uniqueId == null)
                    {
                        query.ValueData = NSData.FromString(System.Guid.NewGuid().ToString());
                        var err = SecKeyChain.Add(query);
                        _Key = query.ValueData.ToString();
                    }
                    else
                    {
                        _Key = uniqueId.ToString();
                    }
                }

                return _Key;
            }
        }

Obfuscate generated binaries before distributing to end users

Set clientCredentialType to Certificate or Windows

Example

The following WCF service provider configuration uses the UsernameToken:

<security mode="Message">
<message clientCredentialType="UserName" />

Set clientCredentialType to Certificate or Windows.

WCF-Security Mode is not enabled

Example

The following configuration sets the security mode to None.

<system.serviceModel>
  <bindings>
    <wsHttpBinding>
      <binding name=""MyBinding"">
        <security mode=""None""/>
      </binding>
  </bindings>
</system.serviceModel>

Example

Security Mode Across all service bindings there are five possible security modes:

• None. Turns security off.
• Transport. Uses transport security for mutual authentication and message protection.
• Message. Uses message security for mutual authentication and message protection.
• Both. Allows you to supply settings for transport and message-level security (only MSMQ supports this).
• TransportWithMessageCredential. Credentials are passed with the message and message protection and server authentication are provided by the transport layer.
• TransportCredentialOnly. Client credentials are passed with the transport layer and no message protection is applied. Use transport and message security to protect the integrity and confidentiality of messages. The configuration below tells the service to use transport security with message credentials.

  <system.serviceModel>
  <bindings>
    <wsHttpBinding>
    <binding name=""MyBinding"">
    <security mode=""TransportWithMessageCredential""/>
    <message clientCredentialType=""Windows""/>
    </binding>
  </bindings>
  </system.serviceModel>