05eb0a61_P_Top_Ten_Cheat_Sheet____OWASP__1
[0] A9 Insufficient Cryptographic Storage [2] Design Use strong ciphers (AES 128 or better) Use strong hashes (SHA 256 or better) with salts for passwords Protect keys more than any other asset Tip: Only certain personally identifiable information and sensitive values MUST be encrypted. Encrypt data that would be embarrassing or costly if it was leaked or stolen. Tip: It is best to encrypt data on the application server, rather than the database server. [3] Design Tip: Do not use RDBMS database, row or table level encryption. The data can be retrieved in the clear by anyone with direct access to the server, or over the network using the application credentials. It might even traverse the network in the clear despite being "encrypted" on disk. [1] 
Design Use strong ciphers (AES 128 or better) Use strong hashes (SHA 256 or better) with salts for passwords Protect keys more than any other asset Render Do not send keys or hashes to the browser
Difference between revisions of "OWASP Top Ten Cheat Sheet" - OWASP