[1] J. Oates AOL man pleads guilty to selling 92m email addies The Register
[2] Privacy Initiatives U.S. Federal Trade Commission
[3] Safe Harbor Privacy Framework U.S. Department of Commerce
[4] Financial Privacy: The Gramm-Leach Bliley Act (GLBA) Federal Trade Commission
[5] Health Insurance Portability and Accountability Act (HIPAA) U.S. Department of Human Services
[6] California SB-1386 Government of the State of California
[7] M. Howard, D. LeBlanc Writing Secure Code, Second Edition Microsoft Press
[9] FUNDAMENTALS-4: Establish trust boundaries Oracle
[10] CONFIDENTIAL-2: Do not log highly sensitive information Oracle
[11] Standards Mapping - Common Weakness Enumeration
CWE ID 359[12] Standards Mapping - Common Weakness Enumeration Top 25 2019
[4] CWE ID 200[13] Standards Mapping - Common Weakness Enumeration Top 25 2020
[7] CWE ID 200[14] Standards Mapping - Common Weakness Enumeration Top 25 2021
[20] CWE ID 200[15] Standards Mapping - Common Weakness Enumeration Top 25 2024
[17] CWE ID 200[16] Standards Mapping - DISA Control Correlation Identifier Version 2
CCI-000169, CCI-000196, CCI-000197, CCI-001199, CCI-001312, CCI-001314[17] Standards Mapping - General Data Protection Regulation (GDPR)
Privacy Violation[18] Standards Mapping - NIST Special Publication 800-53 Revision 4
AC-4 Information Flow Enforcement (P1), AU-12 Audit Generation (P1), IA-5 Authenticator Management (P1), SC-28 Protection of Information at Rest (P1), SI-11 Error Handling (P2)[19] Standards Mapping - NIST Special Publication 800-53 Revision 5
AC-4 Information Flow Enforcement, AU-12 Audit Record Generation, IA-5 Authenticator Management, SC-28 Protection of Information at Rest, SI-11 Error Handling[20] Standards Mapping - OWASP Application Security Verification Standard 4.0
2.2.1 General Authenticator Requirements (L1 L2 L3), 2.6.3 Look-up Secret Verifier Requirements (L2 L3), 2.7.1 Out of Band Verifier Requirements (L1 L2 L3), 2.7.2 Out of Band Verifier Requirements (L1 L2 L3), 2.7.3 Out of Band Verifier Requirements (L1 L2 L3), 2.8.4 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.8.5 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.10.2 Service Authentication Requirements (L2 L3), 2.10.3 Service Authentication Requirements (L2 L3), 3.7.1 Defenses Against Session Management Exploits (L1 L2 L3), 6.2.1 Algorithms (L1 L2 L3), 8.2.1 Client-side Data Protection (L1 L2 L3), 8.2.2 Client-side Data Protection (L1 L2 L3), 8.3.6 Sensitive Private Data (L2 L3), 8.1.1 General Data Protection (L2 L3), 8.1.2 General Data Protection (L2 L3), 8.3.4 Sensitive Private Data (L1 L2 L3), 9.2.3 Server Communications Security Requirements (L2 L3), 10.2.1 Malicious Code Search (L2 L3), 14.3.3 Unintended Security Disclosure Requirements (L1 L2 L3)[21] Standards Mapping - OWASP Mobile 2014
M2 Insecure Data Storage[22] Standards Mapping - OWASP Mobile 2024
M6 Inadequate Privacy Controls[23] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0
MASVS-PLATFORM-2, MASVS-STORAGE-1[24] Standards Mapping - OWASP Top 10 2007
A6 Information Leakage and Improper Error Handling[25] Standards Mapping - OWASP Top 10 2013
A6 Sensitive Data Exposure[26] Standards Mapping - OWASP Top 10 2017
A3 Sensitive Data Exposure[27] Standards Mapping - OWASP Top 10 2021
A02 Cryptographic Failures[28] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1
Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 8.4[29] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2
Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 6.5.6, Requirement 8.4[30] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0
Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 6.5.5, Requirement 8.4[31] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0
Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 8.2.1[32] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1
Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 8.2.1[33] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2
Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 8.2.1[34] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1
Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 8.2.1[35] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0
Requirement 3.3.1, Requirement 3.5.1, Requirement 4.2.2, Requirement 8.3.1[36] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1
Requirement 3.3.1, Requirement 3.3.2, Requirement 3.3.3, Requirement 3.5.1, Requirement 4.2.2, Requirement 8.3.1[37] Standards Mapping - Payment Card Industry Software Security Framework 1.0
Control Objective 3.3 - Sensitive Data Retention, Control Objective 6.1 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography, Control Objective A.2.3 - Cardholder Data Protection[38] Standards Mapping - Payment Card Industry Software Security Framework 1.1
Control Objective 3.3 - Sensitive Data Retention, Control Objective 6.1 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography, Control Objective A.2.3 - Cardholder Data Protection, Control Objective B.2.5 - Terminal Software Design[39] Standards Mapping - Payment Card Industry Software Security Framework 1.2
Control Objective 3.3 - Sensitive Data Retention, Control Objective 6.1 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography, Control Objective A.2.3 - Cardholder Data Protection, Control Objective B.2.5 - Terminal Software Design[40] Standards Mapping - SANS Top 25 2010
Porous Defenses - CWE ID 311[41] Standards Mapping - SANS Top 25 2011
Porous Defenses - CWE ID 311[42] Standards Mapping - Security Technical Implementation Guide Version 3.1
APP3210.1 CAT II, APP3310 CAT I, APP3340 CAT I[43] Standards Mapping - Security Technical Implementation Guide Version 3.4
APP3210.1 CAT II, APP3340 CAT I[44] Standards Mapping - Security Technical Implementation Guide Version 3.5
APP3210.1 CAT II, APP3340 CAT I[45] Standards Mapping - Security Technical Implementation Guide Version 3.6
APP3210.1 CAT II, APP3340 CAT I[46] Standards Mapping - Security Technical Implementation Guide Version 3.7
APP3210.1 CAT II, APP3340 CAT I[47] Standards Mapping - Security Technical Implementation Guide Version 3.9
APP3210.1 CAT II, APP3340 CAT I[48] Standards Mapping - Security Technical Implementation Guide Version 3.10
APP3210.1 CAT II, APP3340 CAT I[49] Standards Mapping - Security Technical Implementation Guide Version 4.2
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[50] Standards Mapping - Security Technical Implementation Guide Version 4.3
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[51] Standards Mapping - Security Technical Implementation Guide Version 4.4
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[52] Standards Mapping - Security Technical Implementation Guide Version 4.5
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[53] Standards Mapping - Security Technical Implementation Guide Version 4.6
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[54] Standards Mapping - Security Technical Implementation Guide Version 4.7
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[55] Standards Mapping - Security Technical Implementation Guide Version 4.8
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[56] Standards Mapping - Security Technical Implementation Guide Version 4.9
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[57] Standards Mapping - Security Technical Implementation Guide Version 4.10
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[58] Standards Mapping - Security Technical Implementation Guide Version 4.11
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[59] Standards Mapping - Security Technical Implementation Guide Version 4.1
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[60] Standards Mapping - Security Technical Implementation Guide Version 5.1
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[61] Standards Mapping - Security Technical Implementation Guide Version 5.2
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[62] Standards Mapping - Security Technical Implementation Guide Version 5.3
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[63] Standards Mapping - Security Technical Implementation Guide Version 6.1
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[64] Standards Mapping - Security Technical Implementation Guide Version 6.2
APSC-DV-000650 CAT II, APSC-DV-001740 CAT I, APSC-DV-001750 CAT I, APSC-DV-002330 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II[65] Standards Mapping - Web Application Security Consortium Version 2.00
Information Leakage (WASC-13)[66] Standards Mapping - Web Application Security Consortium 24 + 2
Information Leakage