In OWASP 2003, A8 Insecure Storage combines related risk themes across Cryptographic Failures, Sensitive Data Exposure. Cryptographic failures expose sensitive data due to weak encryption choices, bad key handling, or missing protection. Sensitive data exposure occurs when private information is stored, transmitted, or displayed without safeguards. These weaknesses are often exploited as a chain: attackers start with weak input or trust boundaries, pivot through authorization or session gaps, and then move toward data exposure, integrity loss, or service disruption. Operationally, this can increase incident frequency, enlarge blast radius, and raise both remediation cost and compliance exposure when controls are missing or inconsistently enforced across services.
For OWASP 2003 A8 Insecure Storage, apply defense in depth across design, implementation, deployment, and operations rather than relying on a single control. Priority controls include: Use modern algorithms, managed key rotation, secure random generation, and encryption for data at rest and in transit. Minimize sensitive data collection, mask outputs, encrypt storage/transit, and enforce strict access policies. Treat mitigation as a continuous program: define security requirements up front, enforce them in CI/CD gates, and verify effectiveness with threat modeling, code review, automated testing, and recurring penetration testing. Add monitoring and incident-response readiness so misconfigurations, abuse patterns, and control regressions are detected early and corrected before they become repeatable attack paths.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2025Latest
#04A04 Cryptographic Failures
↓ Down 2 since 20212021
#02A02 Cryptographic Failures
↑ Up 1 since 20172017
#03A3 Sensitive Data Exposure
↑ Up 4 since 20102010
#07A7 Insecure Cryptographic Storage
↓ Down 1 since 20072007
#06A6 Information Leakage and Improper Error Handling
↑ Up 2 since 20042007
#08A8 Insecure Cryptographic Storage
2004
#08A8 Insecure Storage
No change since 20032003
#08A8 Insecure Storage
