Title

The API must provide protected storage for API keys. (Cat II impact)

Discussion

API key exposure introduces security vulnerabilities to hosted applications. Store API keys securely, avoiding plaintext storage. Avoid plain text storage within application code or application source trees.

Check Content

Verify the API is configured to provide protected storage for API keys, ensuring they are encrypted at rest using cryptographic mechanisms that comply with NIST-approved algorithms and key management standards (e.g., AES-256, FIPS 140-3 validated modules). Protected storage must prevent unauthorized access, tampering, or disclosure of keys, and must enforce access controls consistent with the principle of least privilege. This includes storing keys in secure vaults, hardware security modules (HSMs), or encrypted databases. If the API is not configured to provide protected storage for API keys, this is a finding.

Fix Text

Build or configure the API to provide protected storage using cryptographic mechanisms that comply with NIST-approved algorithms and key management standards (e.g., AES-256, FIPS 140-3 validated modules) for API keys.

Additional Identifiers

Rule ID: SV-274830r1143869_rule

Vulnerability ID: V-274830

Group Title: SRG-APP-000915

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.