Check: SRG-APP-000231-API-000495
Application Programming Interface (API) SRG:
SRG-APP-000231-API-000495
(in version v1 r1)
Title
The API must encrypt sensitive cached data. (Cat I impact)
Discussion
API caching is often used to cache endpoint responses. Caching will reduce the number of calls made to the endpoint and can improve application performance. Cached data can also include sensitive information that must be protected.
Check Content
Verify the API encrypts sensitive data when it is cached. If the API does not encrypt sensitive cached data, this is a finding.
Fix Text
Build or configure the API to encrypt sensitive data when cached.
Additional Identifiers
Rule ID: SV-274607r1143640_rule
Vulnerability ID: V-274607
Group Title: SRG-APP-000231
Expert Comments
Expert comments are only available to logged-in users.
CCIs
CCIs tied to check.
| Number | Definition |
|---|---|
| CCI-001199 |
Protects the confidentiality and/or integrity of organization-defined information at rest. |
Controls
Controls tied to check. These are derived from the CCIs shown above.
| Number | Title |
|---|---|
| SC-28 |
Protection of Information at Rest |