Skip to content
Kodesec × Integrated-Systems.ai
KODESEC
Book a call

A04 · OWASP Top 10 · 3 min

Cryptographic failures. Private data, sent in a see-through envelope.

Encryption is the lock on your data. This is what happens when the lock is missing, outdated, or the key is left lying around.

I run a

In 10 seconds

Sensitive data that anyone who intercepts it can read.

What it is

Encryption scrambles data so only the right people can read it. A failure is when it's missing, outdated or badly managed, so data is readable while it travels or while it's stored.

Why you care

If anyone gets at your data through any other flaw, encryption is the last thing standing between them and your names, addresses, phone numbers and purchase history. It's part of OWASP's Top 10 list of web risks.

What to do

Ask where your sensitive data lives, how it's protected on the move and in storage, and who holds the keys.

For your business

What's at stake for you.

I run a

Who is affected

Your customers, and anyone who trusts you with their details.

What could leak

Names, addresses, phone numbers and purchase history.

Ask this first

“Is every page, especially login and checkout, available only over HTTPS? Who renews our certificate, and when does it expire?”

Where it hides

Pick a place where data needs a lock.

Each one can look fine from the outside and still be open.

http://yourbusiness.com/login
What's here
How data travels between your customer's browser, your app and your servers.
What goes wrong
Parts of the site still load over plain HTTP, or the certificate has expired or is set up wrongly. On public Wi-Fi, others can read or change what passes through.
Ask your team
Is every page, including login and checkout, available only over HTTPS? Who renews our certificate, and when does it expire?
Developers call it
TLS misconfiguration, mixed content, expired certificates, missing HSTS

What it costs

A missing lock makes every other leak worse.

Last line of defence

Encryption is what makes a stolen copy useless. Without it, every leak is a full leak.

Spreads beyond you

Stolen passwords unlock customers' other accounts, and the blame can still land on you.

Legal and card rules

Many laws and card-payment rules expect sensitive data to be encrypted. Duties vary by country and sector.

Visible to customers

Browsers warn visitors about insecure or expired connections, and customers notice.

For an online shop: one leaked, unencrypted backup could expose names, addresses, phone numbers and purchase history.

Does this apply to you?

Tick what's true. Get your questions.

First

So the questions fit you

What kind of business do you run?

A real case

Encrypted, and still readable.

Adobe, 2013

Passwords were "encrypted", but badly.

What it cost
Security researchers used the hints and the repeated patterns to work out many real passwords.
The lesson
Having encryption isn't the same as having it done properly. A lock installed wrongly can fail as badly as no lock.
Read the full story and sources

Attackers took a copy of Adobe's customer database in 2013. Adobe first said about 38 million active users were affected, and later analysis of the leaked file pointed to around 153 million records. The passwords were encrypted, but with one shared key, so identical passwords looked identical, and password hints were stored as plain text.

Security researchers used the hints and the repeated patterns to work out many real passwords. Adobe forced password resets for affected users, and the breach led to lawsuits.

Also: LinkedIn's 2012 breach exposed passwords stored without "salting", so many were cracked quickly. In 2016, data from the same breach covering about 117 million accounts was put up for sale. Sources: Sophos Naked Security (2013), Ars Technica, Krebs on Security.

Your part

Three decisions that are yours.

  1. 01Know your sensitive dataAsk for a list of what you hold, where it lives and why you keep it. Delete what you don't need.
  2. 02Make encryption the defaultOn the move (HTTPS everywhere), in storage, and in backups. Write it into your standards.
  3. 03Own the keysName who controls them, keep them apart from the data, and track when certificates expire.
For your developer: the technical layer
  • TLS 1.2 or newer everywhere, with HSTS, no mixed content and auto-renewing certificates.
  • Passwords: Argon2id, scrypt or bcrypt with a unique salt per user. Never reversible encryption, never MD5 or SHA-1.
  • Encrypt data at rest with modern, well-reviewed algorithms such as AES-256-GCM. Never invent your own cryptography.
  • Keep keys in a key management service or vault, not in code or repositories. Restrict access and rotate them.
  • Use cryptographically secure random generators for tokens, session IDs and reset links.
  • Minimise what you store. For example, let a payment provider hold card numbers so you never do.

Remember

Three things to keep.

  • Encryption is your last line of defence. Without it, any leak is a full leak.
  • A lock is only as good as how it's fitted and where the key is kept.
  • The safest data is the data you never kept.

What OWASP says

The essentials, slide by slide.

A04 · owasp top 10 · 01/04

OWASP Top 10 · A04

cryptographic failures

Source: OWASP Top 10:2025 (CC BY 3.0) ↗

OWASP is a non-profit that publishes the industry's standard list of web risks. Safety measures adapted from the OWASP Top 10:2025 (CC BY 3.0). The people and businesses in the examples are made up.