Contents
How to secure sensitive data when deploying to web servers?
If you are deploying to on-premises web servers, you can help secure secrets by encrypting the configuration sections of configuration files. As an alternative, you can use the same approach recommended for Azure Websites: keep development settings in configuration files, and use environment variable values for production settings.
What are the guidelines for handling sensitive data?
The UNSW Data Handling Guidelines list out these requirements in detail. Generally, the more sensitive the data, the more careful you need to be when storing and using it.
How to test for sensitive data exposure issues?
First, ensure that Burp is correctly configured with your browser. In the Burp Proxy “Intercept” tab ensure “Intercept is off”. Visit the web application you are testing in your browser. Access the log in page of the web application. Return to Burp. In the Proxy Intercept tab, ensure “Intercept is on”.
What should I do if I have sensitive data on my computer?
Device encryption is required for Highly Sensitive data, and on Windows and Mac there are now in-built options for encrypting your computer, and there are options for Linux also. Make sure you use strong passwords (long, containing letters, numbers and punctuation) to secure your device
Which is the best practice for storing passwords?
Best general practice is to minimise access and control rights of each role for each app resource. Example: If an app just uses one database don’t give that user rights to view other or to execute DML on others, remove drop table rights if the app doesn’t do migrations, and so on.
Where do I store my credentials in C #?
The service will not be running under the ownership of the credentials used to make the request; this implies that I need to store the credentials for the request in some way. What are the best practices here? The credentials will need to be stored in App.config (or an analog); I’d rather not have the password hanging out in plain text.
Where is the password stored on a server?
If the server can use external help to boot then the best option would be to require an administrator to enter the password during boot (and keeping the password stored in RAM).