CRITICAL
Rule Definition
Whenever the application is set up to communicate with the database without any encryption in the web config file there are chances that:
1. attacker can alter the information stored in Db
2. execute SQL against the Db
Remediation
Ensure to enable encryption
Violation Code Sample
<connectionStrings>
<add name="connectionstring" connectionString="Data Source=10.200.114.149;Initial
Catalog=2221_Etravel_3.0;User ID=tms_Appuser;Password=********;Max Pool Size=1000"/>
</connectionStrings>
Fixed Code Sample
<add name="connectionstring" connectionString="Data Source=10.200.114.149;Initial
Catalog=2221_Etravel_3.0;Encrypt=yes;User ID=tms_Appuser;Password=********;Max Pool Size=1000"/>
Reference
OWASP Top 10 2017 A3 Sensitive Data Exposure
Related Technologies
Technical Criterion
Secure Coding - Weak Security Features
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.