Does non-persistent data ever need to be encrypted? If I had a project with confidential data stored in non-persistent class variables should I be doing anything to protect this data?
I am developing for an iOS application.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
PCI DSS v3 section 6.5 calls out the need to protect sensitive data even if it is in memory, to help thwart memory scraping attacks. So if you expect to need PCI compliance, yes, you should protect sensitive data even if it's in memory.
I don't know what technology you are using, but even non-persistent data can stick around for a while. For example, strings in .NET don't get automatically destroyed when the all of their references are gone. Strings are stored on the heap and will remain there until the garbage collector removes them.
I have seen this finding on penetration tests.