<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: handling-sensitive-data-securely
description: >-
  Implement secure data handling for PII, credentials, and secrets including encryption and masking.
domain: cybersecurity
subdomain: secure-coding
tags:
  - data-protection
  - encryption
  - pii
  - secure-coding
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1005"]
---

# Handling Sensitive Data Securely

## Overview

Implement secure data handling for PII, credentials, and secrets including encryption and masking.

## Prerequisites

| Requirement | Install |
|---|---|
| cryptography | `pip install cryptography` |
| Vault | Secret management |
| Python 3.10+ | For agent tooling |

## Key Concepts

Sensitive data requires encryption at rest and in transit, key
management, log masking, secure deletion, and access controls.

## Quick Reference

```bash
from cryptography.fernet import Fernet; key = Fernet.generate_key()
node agent.js scan --directory src/ --check sensitive-data
node agent.js audit --file app.py --checks encryption,logging
node agent.js classify --schema schema.sql
```

## Workflow

1. Classify data
2. Encrypt at rest
3. Enforce TLS
4. Mask logs
5. Key management
6. Retention policies
7. Compliance audit

## Detection

```yaml
title: Handling Sensitive Data Securely Detection
id: bda9ffee-5035-4cf6-a8f8-e6d0f86fb40d
status: experimental
description: Detects suspicious activity related to handling sensitive data securely techniques in secure coding context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1005
  - attack.initial_access
falsepositives:
  - Static analysis tools scanning source code repositories
```

## Verification

- Verify encryption
- Confirm TLS
- Validate clean logs
- Check key rotation
- Verify deletion

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
