Issue Details
Insecure Communications
Aliases: None
Explanation
In OWASP 2007, A9 Insecure Communications combines related risk themes across Transport Layer Protection, Cryptographic Failures. Transport security issues expose data in transit due to weak TLS configuration or insecure channels. Cryptographic failures expose sensitive data due to weak encryption choices, bad key handling, or missing protection. These weaknesses are often exploited as a chain: attackers start with weak input or trust boundaries, pivot through authorization or session gaps, and then move toward data exposure, integrity loss, or service disruption. Operationally, this can increase incident frequency, enlarge blast radius, and raise both remediation cost and compliance exposure when controls are missing or inconsistently enforced across services.
Remedy
For OWASP 2007 A9 Insecure Communications, apply defense in depth across design, implementation, deployment, and operations rather than relying on a single control. Priority controls include: Enforce TLS 1.2+, disable weak ciphers, enable HSTS, and validate certificates in all client-server channels. Use modern algorithms, managed key rotation, secure random generation, and encryption for data at rest and in transit. Treat mitigation as a continuous program: define security requirements up front, enforce them in CI/CD gates, and verify effectiveness with threat modeling, code review, automated testing, and recurring penetration testing. Add monitoring and incident-response readiness so misconfigurations, abuse patterns, and control regressions are detected early and corrected before they become repeatable attack paths.
| Year | Rank | Category |
|---|---|---|
| 2007 | #9 | A9 - Insecure Communications |
| 2010 | #9 | A9 - Insufficient Transport Layer Protection |
| 2021 | #2 | A02 - Cryptographic Failures |
| 2025 | #4 | A04 - Cryptographic Failures |