Cryptographic Failures: An OWASP Top 10 Threat

What is cryptography?

To understand cryptographic failures, it is important to first understand cryptography. Cryptography is a method of securing communication so only authorized parties can access the information. It involves converting readable data (plaintext) into an unreadable format (ciphertext) using encryption algorithms. Only those with the correct cryptographic key can decrypt the message back to its original form.

Cryptography is foundational in modern computing and is used in:

• Secure protocols: HTTPS, FTPS, SFTP, SSH, SMTPS, etc., to encrypt communications
• Hashing: Securing passwords, authentication processes, and verifying file integrity
• Digital certificates: Verifying website authenticity

What is a cryptographic failure?

Cryptographic failure occurs when encryption, hashing, or key management is incorrectly implemented or used. These failures often result from:

• Misconfigurations
• Use of outdated or weak encryption algorithms
• Poor handling of cryptographic keys
• Incorrect integration of cryptographic libraries
• Not encrypting data at all

These issues typically stem from implementation or configuration flaws rather than problems with the cryptographic algorithms themselves. Because cryptography protects sensitive data, any failure can expose information to malicious actors and lead to severe security breaches.

Examples of attacks that exploit cryptographic failures

Attackers can exploit these weaknesses to access or tamper with sensitive data. Examples include man-in-the-middle attacks due to misconfigured HTTPS, brute-force attacks on passwords stored with outdated hashing algorithms, extraction of hardcoded cryptographic keys, and interception of unencrypted API traffic.

How to prevent cryptographic failures

Preventing these issues involves applying secure, modern practices:

• Use up-to-date cryptographic standards like AES-256 for encryption and SHA-256 for hashing.
• Enforce TLS with valid certificates and HSTS headers to secure communications.
• Encrypt sensitive data both in transit and at rest.
• Avoid hardcoding secrets and rotate keys periodically.
• Utilize or integrate with secrets management solutions
• Regularly test for misconfigurations and deprecated protocols.

What are the dangers of cryptographic failures?

These failures can result in unauthorized data exposure, regulatory non-compliance, reputational harm, and operational disruption. For small and medium-sized businesses, such incidents can be particularly damaging due to limited resources and recovery options.

Risk factors that can lead to cryptographic failure

Common risk factors include a lack of dedicated security expertise, reliance on legacy systems or defaults, insufficient testing, and uneven application of encryption controls. Smaller organizations may also underestimate their exposure to targeted attacks.

How is cryptographic failure exploited by hackers?

Hackers can target weak encryption settings or improperly stored secrets. They may downgrade HTTPS sessions, extract embedded keys, or exploit predictable password hashes, which allow them to bypass security controls with minimal effort.

How to accurately assess potential cryptographic failure vulnerabilities in applications

Start by identifying areas where sensitive data is handled. Review encryption algorithms and configurations. Use security testing tools to find weak spots, and verify that APIs and third-party services apply proper protections. 

A DAST-first security platform can strengthen your assessment by actively scanning running applications for exploitable cryptographic weaknesses. Unlike static tools that highlight theoretical risks, using a vulnerability scanner with a DAST-first approach focuses on real-world exposure, such as unencrypted endpoints, broken HTTPS enforcement, or misconfigured headers. By validating findings through proof-based scanning, DAST reduces false positives and helps prioritize remediation of actual risks, allowing small teams to secure their applications more effectively.

THE AUTHOR

Alexa Rogers