Cryptographic & Security Practice Flaws

Systems and sensitive data can be protected through techniques such as authentication, authorization and encryption. Developers should stick to using security techniques and libraries that have already been created, tested and verified and should not attempt to create their own security algorithms. These will only likely introduce new vulnerabilities.

Common Patterns 

• Using deprecated or weak algorithms like MD5, SHA-1, or ECB mode
• Hard-coded secrets in code or configuration
• Poor key rotation or management practices
• Lack of encryption for sensitive data at rest or in transit
• Self-signed or invalid TLS certificates
• Using AI/ML systems without proper secret handling for model parameters or sensitive inputs

How To Prevent It

• Use strong, modern algorithms such as AES-GCM, ChaCha20-Poly1305, or enforce TLS 1.3 with valid certificates
• Use secure key management services like Azure Key Vault, AWS KMS, or HashiCorp Vault
• Rotate secrets and keys regularly, following defined crypto periods
• Document and enforce policies and standard operating procedures for key lifecycle management
• Maintain a complete inventory of certificates, keys, and their owners
• Ensure AI models and automation agents never expose unencrypted secrets or sensitive data