Owasp Infrastructure

title: 'ISR05: Insecure Use of Cryptography' description: OWASP Infrastructure Top 10 reference for cryptography vulnerabilities including weak algorithms and unencrypted internal communications

05 Insecure Use of Cryptography

Identifier: ISR05:2024 Category: Data Protection

Description

Insecure use of cryptography occurs when encryption and cryptographic methods are not sufficiently implemented on systems and protocols used in the internal network. This is well understood for external applications but is often overlooked for internal infrastructure. If sufficient encryption is absent, an adjacent threat actor may read, modify, or inject data into communications and systems. A defense line only to the outside does not fully protect internal systems; once an attacker gains internal network access (e.g., via phishing), external defenses are largely bypassed. Internal infrastructure security must be as strong as, or stronger than, external system security.

Risk

• Information leakage and compromise of privileged accounts when insecure cryptographic methods or configurations are used.

• Significantly increased chance of devastating cyberattacks and greater impact.

• Unencrypted remote access protocols allow adjacent threat actors to read credentials from network traffic.

• Protocols without cryptographic integrity checks enable man-in-the-middle attacks where data is modified in transit.

Vulnerability checklist

• Remote access tools (e.g., Telnet, unencrypted RDP) transmit credentials in clear text.

• Protocols in use do not perform cryptographic identity or integrity checks.

• Insecure or deprecated cryptographic algorithms are configured on internal systems.

• Internally developed cryptographic implementations are used instead of established libraries.

• Communication paths between internal systems lack encryption.

Prevention controls

1. Ensure all protocols, communication tools, remote access tools, and data transfer tools are configured to use secure cryptographic methods and configurations.

2. Migrate protocols that do not support secure encryption to secure alternatives (Telnet to SSH, FTP to SFTP).

3. Verify that cryptographic methods and configurations are sufficient, implemented per best practices, and follow official recommendations.

4. Use publicly available and established cryptographic libraries; do not develop custom cryptographic implementations.

Example attack scenarios

Scenario A — Unencrypted remote access tools

A company has an internal infrastructure with servers providing applications to employees, including a CRM system holding sensitive customer data. A threat actor gains access to the internal network through a misconfigured internet-exposed system. The threat actor sniffs internal network traffic from the compromised machine. An administrator connects to an internal file server using Telnet to perform an update. Because Telnet transmits data without encryption, the administrator's credentials are sent in clear text. The threat actor captures the credentials and uses them to log on to the CRM server, exfiltrating all customer data.

Scenario B — Insufficient use of cryptography

A company has an internal infrastructure with an invoice management application. A threat actor gains access to the internal network and can inspect and inject packets into traffic. An employee connects to the invoice system to create invoices. The communication protocol is encrypted but does not perform a cryptographic identity or integrity check. The threat actor performs a man-in-the-middle attack, modifying data packets to redirect invoice payments from the company's account to an attacker-controlled account. Customers unknowingly transfer money to the attacker.

Detection guidance

• Scan internal network traffic for unencrypted protocols (Telnet, FTP, unencrypted RDP).

• Audit cryptographic configurations on servers, remote access tools, and data transfer services.

• Identify use of deprecated algorithms or cipher suites in internal communications.

• Monitor for man-in-the-middle indicators such as certificate warnings or unexpected traffic patterns.

Remediation

• Replace all unencrypted protocols with secure alternatives (SSH, SFTP, encrypted RDP).

• Update cryptographic configurations to use current, recommended algorithms and cipher suites.

• Remove internally developed cryptographic implementations and adopt established libraries.

• Enable cryptographic identity and integrity verification on all internal communication protocols.

• Conduct a full audit of internal communication paths and remediate any unencrypted channels.