Agent WranglersAPS-54Required
Encrypt data on the wire and on disk
Encrypt every connection, including those between your own servers. Encrypt stored personal data and backups.
How to do it
Use TLS 1.2 or 1.3 for the database, cache and internal services, not only for visitors, and verify the server's certificate. Turn on disk or database encryption, and encrypt backups. Store passwords as slow hashes. For public TLS settings, see the website TLS rule. For more depth, see encrypted backups and field encryption.
How to check
The agent tries a plain connection to the database and cache from inside staging. Both refuse it, and so does a TLS 1.1 connection. The backup files cannot be read without a key.
Sources
Related rules
- DAT-41 Give the app a least-privilege database user in Data and databases
- DAT-26 Encrypt backups in Data and databases
- INF-33 Force encryption on every managed service in Infrastructure and environments
- APS-23 Make browsers always use HTTPS in Application security
- APS-24 Load nothing over plain HTTP in Application security
- APS-11 Store passwords with a slow hash in Application security
- APS-55 Turn off old encryption in Application security
- APS-58 Encrypt the most sensitive fields in Application security
- APS-57 Keep encryption keys in a key service in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/cryptography-and-keys/encrypt-data">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.