Cryptographic Failures Root Cause Analysis

Cryptographic Failures

• Algorithm Selection
  • Weak encryption methods used
  • Symmetric encryption without key rotation
  • Use of outdated algorithms
  • MD5 or SHA-1 used for hashing
• Key Management
  • Insecure key storage
  • Keys stored in plain text
  • Hardcoded keys in codebase
  • Keys exposed in version control
• Implementation Flaws
  • Custom cryptographic protocols
  • Non-standard design vulnerable to attack
  • Incorrect use of cryptographic libraries
  • Missing initialization vectors (IVs)
• Certificate Management
  • Improper certificate validation
  • No hostname verification
  • Expired or self-signed certificates
  • TLS handshake fails or bypassed
• Data Protection Practices
  • Improper encryption of data in transit
  • Lack of HTTPS on sensitive endpoints
  • Sensitive data not encrypted
  • PII stored in plaintext
• Organizational Oversight
  • Inadequate developer training
  • Developers unaware of secure crypto practices
  • Lack of cryptography standards
  • No policies for algorithm and key use

Suggested Actions Checklist

Here are some corrective actions, preventive actions and investigative actions that organizations may find useful:

• Algorithm Selection
  • Weak encryption methods used
    • Corrective Actions:
    • Replace weak encryption algorithms with industry-standard options like AES-256.
    • Preventive Actions:
    • Establish mandatory cryptographic algorithm policies based on current NIST recommendations.
    • Investigative Actions:
    • Review all current systems to identify where weak algorithms are deployed and assess associated risks.
  • Use of outdated algorithms
    • Corrective Actions:
    • Deprecate outdated algorithms such as DES and 3DES from all services and applications.
    • Preventive Actions:
    • Maintain an up-to-date cryptography policy that tracks algorithm deprecation timelines.
    • Investigative Actions:
    • Conduct a codebase scan to detect and catalog all instances of outdated algorithm usage.
• Key Management
  • Insecure key storage
    • Corrective Actions:
    • Migrate all keys to secure vaults or hardware security modules (HSMs).
    • Preventive Actions:
    • Enforce policies requiring secure storage for all cryptographic keys.
    • Investigative Actions:
    • Review and map current key storage practices across environments.
  • Hardcoded keys in codebase
    • Corrective Actions:
    • Remove hardcoded keys and replace them with references to secure key vaults.
    • Preventive Actions:
    • Apply code review policies that specifically check for hardcoded secrets.
    • Investigative Actions:
    • Use scanning tools to search repositories for embedded keys.
• Implementation Flaws
  • Custom cryptographic protocols
    • Corrective Actions:
    • Replace custom protocols with proven, standardized cryptographic libraries.
    • Preventive Actions:
    • Mandate the use of vetted libraries only, disallowing custom cryptography.
    • Investigative Actions:
    • Review all components using custom cryptography to assess security weaknesses.
  • Incorrect use of cryptographic libraries
    • Corrective Actions:
    • Refactor affected code to correctly implement library functions as per documentation.
    • Preventive Actions:
    • Provide comprehensive guidelines and training on proper use of cryptographic libraries.
    • Investigative Actions:
    • Audit usage patterns of crypto libraries across the codebase.
• Certificate Management
  • Improper certificate validation
    • Corrective Actions:
    • Implement strict validation checks including chain-of-trust and revocation status.
    • Preventive Actions:
    • Use standard libraries and frameworks that handle certificate validation automatically.
    • Investigative Actions:
    • Review application logs and behavior for signs of certificate validation bypasses.
  • Expired or self-signed certificates
    • Corrective Actions:
    • Replace expired or self-signed certificates with valid, CA-signed certificates.
    • Preventive Actions:
    • Automate certificate renewal and monitor certificate expiration dates.
    • Investigative Actions:
    • Inventory and assess the validity of all certificates in use.
• Data Protection Practices
  • Improper encryption of data in transit
    • Corrective Actions:
    • Enforce TLS 1.2 or higher on all data transmission channels.
    • Preventive Actions:
    • Mandate HTTPS and secure transport protocols in design specifications.
    • Investigative Actions:
    • Perform network traffic analysis to detect unencrypted transmissions.
  • Sensitive data not encrypted
    • Corrective Actions:
    • Apply field-level or full-database encryption on all sensitive data elements.
    • Preventive Actions:
    • Define data classification policies requiring encryption for all personally identifiable information (PII).
    • Investigative Actions:
    • Review data schemas and storage mechanisms for unprotected sensitive data.
• Organizational Oversight
  • Inadequate developer training
    • Corrective Actions:
    • Launch mandatory secure coding and cryptography training programs.
    • Preventive Actions:
    • Incorporate secure development lifecycle (SDL) practices in onboarding and upskilling.
    • Investigative Actions:
    • Survey developer knowledge gaps through assessments and interviews.
  • Lack of cryptography standards
    • Corrective Actions:
    • Develop and enforce organizational standards for algorithm selection, key management, and certificate handling.
    • Preventive Actions:
    • Review and update cryptographic standards regularly to align with evolving threats.
    • Investigative Actions:
    • Benchmark current practices against industry standards (e.g., NIST, ISO) to identify gaps.