This is when protecting sensitive data in an application. As given in the OWASP Top 10: A6 Sensitive Data Exposure.


The answer is mentioned next to the sentence in the cheat sheet that you read.

Do not use RDBMS database, row or table level encryption. The data can be retrieved in the clear by anyone with direct access to the server, or over the network using the application credentials. It might even traverse the network in the clear despite being "encrypted" on disk.

Basically, if you encrypt only in the DB, then sensitive data can still be read while it travels from the app server to the DB and on the way back.

You could use two-layers of encryption depending on your security/performance requirements and threat model.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.