97 Things Every Application Security Professional Should Know

Chapter 39. Protect Sensitive Data in Modern Applications

Louisa Wang

In the application security world, other than security design, code scanning, and WAFs, there are other security controls that developers should know and apply as needed, such as encrypting data and managing crypto keys properly.

Learn Key Management

Key management involves the procedures and systems for the generation, exchange, storage, use, crypto-shredding (destruction), and replacement of encryption keys. Meticulous key management is vital, as it ensures the security of even the strongest encryption solutions. However, designing and implementing a key management system (KMS) can be complex at times. For example, you can pick a hardware security module (HSM), which is a physical device specifically built to securely store and manage encryption keys. Or you can choose Trusted Platform Module (TPM), which is the computer chip built into endpoints (e.g., laptops) that securely stores encryption keys and certificates. Knowing what they are and where to apply them is the key.

Additionally, learn the crypto ecosystem. Systems like TLS use fundamental elements such as ciphers, hashes, blockchaining modes, and key agreement protocols for security. Avoid creating your own cryptographic primitives; it’s time-consuming, demanding of expertise, and crucial for correctness and effectiveness. Pay attention to key ...