{"action":"created","issue":{"url":"https://api.github.com/repos/OWASP/owasp-masvs/issues/31","repository_url":"https://api.github.com/repos/OWASP/owasp-masvs","labels_url":"https://api.github.com/repos/OWASP/owasp-masvs/issues/31/labels{/name}","comments_url":"https://api.github.com/repos/OWASP/owasp-masvs/issues/31/comments","events_url":"https://api.github.com/repos/OWASP/owasp-masvs/issues/31/events","html_url":"https://github.com/OWASP/owasp-masvs/issues/31","id":183847487,"number":31,"title":"Missing a requirement \"Verify that no sensitive data is stored unencrypted.\"","user":{"login":"sushi2k","id":5951320,"avatar_url":"https://avatars.githubusercontent.com/u/5951320?v=3","gravatar_id":"","url":"https://api.github.com/users/sushi2k","html_url":"https://github.com/sushi2k","followers_url":"https://api.github.com/users/sushi2k/followers","following_url":"https://api.github.com/users/sushi2k/following{/other_user}","gists_url":"https://api.github.com/users/sushi2k/gists{/gist_id}","starred_url":"https://api.github.com/users/sushi2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sushi2k/subscriptions","organizations_url":"https://api.github.com/users/sushi2k/orgs","repos_url":"https://api.github.com/users/sushi2k/repos","events_url":"https://api.github.com/users/sushi2k/events{/privacy}","received_events_url":"https://api.github.com/users/sushi2k/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/OWASP/owasp-masvs/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/OWASP/owasp-masvs/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-10-19T02:00:11Z","updated_at":"2016-10-24T06:37:55Z","closed_at":null,"body":"Hi,\r\n\r\nI think we are missing a requirement in \"V2: Data Storage and Privacy requirements\", which is to not store sensitive data in cleartext. In the first requirement we are only talking about credentials and keys, but there might be a lot of other sensitive information that need to be identified and the applicable security controls need to applied to them too.\r\n\r\nSo we should have another requirement like \"Verify that no sensitive data is stored unencrypted.\".\r\n\r\nOr am I missing something and this is already covered somewhere else?\r\n\r\nhttps://github.com/OWASP/owasp-masvs/blob/master/Document/0x07-V2-Data_Storage_and_Privacy_requirements.md\r\n "},"comment":{"url":"https://api.github.com/repos/OWASP/owasp-masvs/issues/comments/255659357","html_url":"https://github.com/OWASP/owasp-masvs/issues/31#issuecomment-255659357","issue_url":"https://api.github.com/repos/OWASP/owasp-masvs/issues/31","id":255659357,"user":{"login":"b-mueller","id":5194767,"avatar_url":"https://avatars.githubusercontent.com/u/5194767?v=3","gravatar_id":"","url":"https://api.github.com/users/b-mueller","html_url":"https://github.com/b-mueller","followers_url":"https://api.github.com/users/b-mueller/followers","following_url":"https://api.github.com/users/b-mueller/following{/other_user}","gists_url":"https://api.github.com/users/b-mueller/gists{/gist_id}","starred_url":"https://api.github.com/users/b-mueller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/b-mueller/subscriptions","organizations_url":"https://api.github.com/users/b-mueller/orgs","repos_url":"https://api.github.com/users/b-mueller/repos","events_url":"https://api.github.com/users/b-mueller/events{/privacy}","received_events_url":"https://api.github.com/users/b-mueller/received_events","type":"User","site_admin":false},"created_at":"2016-10-24T06:37:55Z","updated_at":"2016-10-24T06:37:55Z","body":"-> Keying materials should always be stored in the credential storage facilities.\r\n-> Sensitive information, if stored on the device, should be encrypted with the keying materials stored on either the server (l4) or on the credential storage facilities (l2-l3).\r\n\r\nI think these two cover it perfectly."}}
{"actor":{"display_login":"b-mueller"}}