Agent WranglersData and secrets Required
Encrypt data on the wire and on disk
Encrypt every connection, including those between your own servers. Encrypt stored personal data and backups.
How to do it
Use TLS for the database, cache and internal services, not only for visitors. Turn on disk or database encryption, and encrypt backups. Store passwords as slow hashes. For public TLS settings, see the website TLS rule. For more depth, see encrypted backups and field encryption.
How to check
The agent tries a plain connection to the database and cache from inside staging. Both refuse it. The backup files cannot be read without a key.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/encrypt-data.