What is Missing Encryption of Sensitive Data (CWE-311)?

TL;DR: CWE-311 occurs when sensitive or critical information is not encrypted before storage or transmission, making it vulnerable to unauthorized access and manipulation.

At-a-Glance

What is Missing Encryption of Sensitive Data?

Missing Encryption of Sensitive Data (CWE-311) is a type of Insecure Design vulnerability that occurs when sensitive or critical information is not encrypted before storage or transmission. As defined by the MITRE Corporation under CWE-311, and classified by the OWASP Foundation under A06:2025 - Insecure Design…

Quick Summary

Missing Encryption of Sensitive Data (CWE-311) can lead to unauthorized access and manipulation of sensitive information, resulting in financial losses, compliance issues, and damage to reputation. This vulnerability occurs when sensitive or critical information is not encrypted before storage or transmission.

Jump to: What is Missing Encryption of Sensitive Data? · Quick Summary · Missing Encryption of Sensitive Data Overview · How Missing Encryption of Sensitive Data Works · Business Impact of Missing Encryption of Sensitive Data · Missing Encryption of Sensitive Data Attack Scenario · How to Detect Missing Encryption of Sensitive Data · How to Fix Missing Encryption of Sensitive Data · Framework-Specific Fixes for Missing Encryption of Sensitive Data · How to Ask AI to Check Your Code for Missing Encryption of Sensitive Data · Missing Encryption of Sensitive Data Best Practices Checklist · Missing Encryption of Sensitive Data FAQ · Vulnerabilities Related to Missing Encryption of Sensitive Data · References · Scan Your Own Site

Missing Encryption of Sensitive Data Overview

What: CWE-311 occurs when sensitive or critical information is not encrypted before storage or transmission.

Why it matters: CWE-311 can lead to unauthorized access and manipulation of sensitive information, resulting in financial losses, compliance issues, and damage to reputation.

Where it occurs: CWE-311 can occur in web applications, APIs, databases, and other systems that handle sensitive information.

Who is affected: CWE-311 affects organizations that store or transmit sensitive information without proper encryption.

Who is NOT affected: CWE-311 does not affect organizations that properly encrypt sensitive information before storage or transmission.

How Missing Encryption of Sensitive Data Works

Root Cause

The root cause of CWE-311 is the lack of encryption for sensitive or critical information before storage or transmission.

Attack Flow

1. An attacker gains access to the system.
2. The attacker exploits the vulnerability by accessing unencrypted sensitive data.
3. The attacker manipulates the sensitive data to their advantage.

Prerequisites to Exploit

• Sensitive data is stored or transmitted without encryption.
• The attacker has access to the system.

Vulnerable Code

import os

# Unencrypted sensitive data
data = "Sensitive information"

# Store unencrypted data in a file
with open("sensitive_data.txt", "w") as f:
    f.write(data)

The vulnerable code above stores unencrypted sensitive data in a file.

Secure Code

import os
from cryptography.fernet import Fernet

# Generate encryption key
key = Fernet.generate_key()

# Encrypt sensitive data
data = "Sensitive information"
encrypted_data = Fernet(key).encrypt(data.encode())

# Store encrypted data in a file
with open("sensitive_data.txt", "wb") as f:
    f.write(encrypted_data)

The secure code above encrypts sensitive data before storing it.

Business Impact of Missing Encryption of Sensitive Data

Confidentiality

• Unauthorized access to sensitive information.
• Loss of confidentiality due to unencrypted storage or transmission.

Integrity

• Manipulation of sensitive information by attackers.
• Loss of integrity due to unencrypted storage or transmission.

Availability

• System downtime due to unauthorized access or manipulation of sensitive data.
• Loss of availability due to unencrypted storage or transmission.

Missing Encryption of Sensitive Data Attack Scenario

1. An attacker gains access to the system.
2. The attacker exploits the vulnerability by accessing unencrypted sensitive data.
3. The attacker manipulates the sensitive data to their advantage.

How to Detect Missing Encryption of Sensitive Data

Manual Testing

• Review code for encryption of sensitive data.
• Test storage and transmission protocols for encryption.

Automated Scanners (SAST/DAST)

• Static analysis tools can detect missing encryption in code.
• Dynamic analysis tools can detect missing encryption during runtime.

PenScan Detection

PenScan’s scanner engines actively test for this issue.

False Positive Guidance

• CWE-311 false positives may occur when sensitive data is encrypted but not properly configured.
• Review code and configuration to ensure proper encryption.

How to Fix Missing Encryption of Sensitive Data

• Implement encryption for sensitive data using industry-approved techniques.
• Use secure protocols for transmission, such as HTTPS or TLS.
• Ensure proper configuration of encryption algorithms.

Framework-Specific Fixes for Missing Encryption of Sensitive Data

Java

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;

// Generate encryption key
SecretKeySpec key = new SecretKeySpec("secret_key".getBytes(), "AES");

// Encrypt sensitive data
String data = "Sensitive information";
byte[] encryptedData = Cipher.getInstance("AES").encrypt(data.getBytes());

Node.js

const crypto = require('crypto');

// Generate encryption key
const key = crypto.randomBytes(32);

// Encrypt sensitive data
const data = "Sensitive information";
const encryptedData = crypto.createCipheriv('aes-256-cbc', key, null).update(data);

Python/Django

from cryptography.fernet import Fernet

# Generate encryption key
key = Fernet.generate_key()

# Encrypt sensitive data
data = "Sensitive information"
encrypted_data = Fernet(key).encrypt(data.encode())

How to Ask AI to Check Your Code for Missing Encryption of Sensitive Data

Review your code using an AI coding assistant and rewrite it using a primary fix technique.

Missing Encryption of Sensitive Data Best Practices Checklist

✅ Verify return values are correct. ✅ Test your code thoroughly. ✅ Use allowlists to ensure proper configuration of encryption algorithms. ✅ Implement encryption for sensitive data using industry-approved techniques.

Missing Encryption of Sensitive Data FAQ

How do I prevent CWE-311?

Clearly specify which data or resources are valuable enough that they should be protected by encryption, and require that any transmission or storage of this data/resource use well-vetted encryption algorithms.

What is the business impact of CWE-311?

CWE-311 can lead to unauthorized access and manipulation of sensitive information, resulting in financial losses, compliance issues, and damage to reputation.

How do I detect CWE-311?

Use manual testing, automated scanners (SAST/DAST), and PenScan detection to identify potential vulnerabilities.

How do I fix CWE-311?

Implement encryption for sensitive data, use secure protocols for transmission, and ensure proper configuration of encryption algorithms.

What are the framework-specific fixes for CWE-311?

Use industry-approved techniques, such as libraries or frameworks, to implement encryption and ensure that it is properly integrated into the system design.

How do I ask AI to check my code for CWE-311?

Review your code using an AI coding assistant and rewrite it using a primary fix technique.

What are the best practices for preventing CWE-311?

Verify return values, test your code, use allowlists, and ensure proper configuration of encryption algorithms.

How do I prevent CWE-311 in my web application?

Implement encryption for sensitive data, use secure protocols for transmission, and ensure proper configuration of encryption algorithms.

Vulnerabilities Related to Missing Encryption of Sensitive Data

References

• MITRE CWE-311
• OWASP A06:2025 - Insecure Design
• CAPEC-157, CAPEC-158, CAPEC-204, CAPEC-31, CAPEC-37, CAPEC-383, CAPEC-384, CAPEC-385, CAPEC-386, CAPEC-387, CAPEC-388, CAPEC-477, CAPEC-609, CAPEC-65
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Missing Encryption of Sensitive Data and other risks before an attacker does.