Toc for Sensitive Data storage cheatsheet #377

northdpole · 2020-03-28T19:56:45Z

Thank you for submitting a Pull Request (PR) to the Cheat Sheet Series.

🚩 If your PR is related to grammar/typo mistakes, please double-check the file for other mistakes in order to fix all the issues in the current cheat sheet.

Please make sure that for your contribution:

In case of a new Cheat Sheet, you have used the Cheat Sheet template.
All the markdown files do not raise any validation policy violation, see the policy.
All the markdown files follow these format rules.
All your assets are stored in the assets folder.
All the images used are in the PNG format.
Any references to websites have been formatted as TEXT
You verified/tested the effectiveness of your contribution (e.g., the defensive code proposed is really an effective remediation? Please verify it works!).
The CI build of your PR pass, see the build status here.

If your PR is related to an issue, please finish your PR text with the following line:

This PR covers issue #.

Thank you again for your contribution 😃

rbsec · 2020-03-29T14:19:21Z

Hi @northdpole.

My initial thoughts would be about how this fits in with the existing cheat sheets. We currently have:

Choosing and Using Security Questions (covers how to store answers for them)
Cryptographic storage (covers different ways to encrypt, algorithms, key management, etc)
Database Security (covers access control/permissions for database)
Key Management (although this is an older cheat sheet and could do with an update)
Password Storage (covers password/API key hashing)

Looking at the proposed ToC, it feels like there would be quite a lot of duplication with the existing cheat sheets, and potentially more confusion for the end user in terms of where they should be looking for information. Should this be a new cheat sheet in its own right, or perhaps should the we fill in any missing gaps in the existing cheat sheets with this content?

@ThunderSon @mackowski, what do you think?

Thanks

ThunderSon · 2020-03-29T14:22:54Z

My thoughts on this are to make this pertaining to topics related to secure storage, and linking accordingly into the other ones. One example would be that this CS talks about permissions, and the DB CS references it. This can be done based on which is the bigger focus. So a KMS CS focuses on the keys and how to secure them, so this CS should reference them, and where the KMS needs things related to general storage factors, it references it from this CS

mackowski

I like this but we have to very carefully make sure to not duplicate the content of other CSs. I like @ThunderSon idea how it can look like.
But what I like even more is to cover this topic #124 this is wider topic but if @northdpole can take it with our help it will be awesome. It will also have more unique content that will justify the need of a separate CS.

ThunderSon · 2020-04-26T19:14:00Z

@northdpole is busy currently, so this will be put on hold till they're around for more updates.

northdpole · 2020-04-26T20:44:37Z

I like this but we have to very carefully make sure to not duplicate the content of other CSs. I like @ThunderSon idea how it can look like.
But what I like even more is to cover this topic #124 this is wider topic but if @northdpole can take it with our help it will be awesome. It will also have more unique content that will justify the need of a separate CS.

We can make this the opposite, it could be as simple as pointing to subsections of other cheatsheets instead of being a full blown document. What do you think? this would minimize overall edits you have to do.

@ThunderSon
I can write this in my current timeframe :) ( got some notes already from another project).
Thanks for being considerate! Highly appreciated :-)

In short, I'd be happy to help. Would you like a draft or otherwise how do you prefer on getting started?

ThunderSon · 2020-04-29T20:29:07Z

@northdpole Based on our discussion on Slack, we agreed on a small touch-up on the ToC. Once that is done, I'll move forward and link sheets to the relevant sections, and then it'd be clearer for you on what is required and missing to be described properly.

mackowski · 2020-07-29T07:39:03Z

@northdpole are you still around? This can be an awesome CS

northdpole · 2020-08-04T22:17:09Z

Yes I'm around! Happy to create it! I'm currently on holiday which may also accelerate stuff ;) gimme a week or so for the first draft

…

On Wed, 29 Jul 2020, 10:39 mackowski, ***@***.***> wrote: @northdpole <https://github.com/northdpole> are you still around? This can be an awesome CS — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#377 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAMCRHT7D7DMYUZU6T7OGCLR57G2NANCNFSM4LVWDKOQ> .

mackowski · 2020-08-05T06:46:54Z

@northdpole good to hear that! If you need any help from us let us know :)

add suggested links to other cheatsheets, update ToC slightly add questions?

northdpole · 2020-08-05T15:04:28Z

added some content and comments, let me know what do you think and i can edit accordingly :)

cheatsheets_draft/Sensitive_Data_Storage_Cheat_Sheet.md

mackowski · 2020-08-06T06:41:35Z

cheatsheets_draft/Sensitive_Data_Storage_Cheat_Sheet.md

+The unintented advantage of this approach is that if a user's data needs to be deleted, only the associated key needs to be destroyed as this will make data unusable.
+
+## Tokenizing
+<this can be a cheatsheet by itself which does not exist currently do we want to do this?>


I would like to do this, maybe we can start here and it this grow too much we can create new CS

For tokenizing, it is really a niche subject not directly related to sensitive data storage. It is closer to Sensitive Data Handling. So I removed it from this cheatsheet but opened a ticket to create a new one #471

cheatsheets_draft/Sensitive_Data_Storage_Cheat_Sheet.md

mackowski · 2020-08-06T06:46:33Z

cheatsheets_draft/Sensitive_Data_Storage_Cheat_Sheet.md

+## Cloud Storage
+<there isn't a relevant cheatsheet for this>
+
+# Managing Secrets


We are also creating new CS: #124

should we postpone merging until #124 lands?

address comments v1

address comments v2

mackowski · 2020-08-18T06:49:47Z

@jmanico what do you think about this CS? Do we want to keep it, this is basically linking to all content from other CSs?

jmanico · 2020-08-18T18:13:01Z

@jmanico what do you think about this CS? Do we want to keep it, this is basically linking to all content from other CSs?

I think this is a really interesting idea. In general, I want to welcome contributions that use our sheets in unique ways. :)

mackowski

@northdpole The links are not working. Links in the Contents are good but for all other links you are using a wrong syntax. After you fix it we can merge.

mackowski · 2020-09-23T12:17:15Z

@northdpole do you need any help from us?

mackowski · 2020-11-16T12:14:22Z

@northdpole hey do you need any help from us? Do you want to work on this further?

mackowski · 2021-03-02T09:52:25Z

I am closing this PR because no updes here were made in about 6 months. @northdpole feel free to re-open it whan you will have time to work on that.

northdpole added 2 commits March 28, 2020 19:15

very initial draft on sensitive data storage cheat sheet

67d2ca7

toc

57747c2

northdpole requested review from mackowski, rbsec and ThunderSon as code owners March 28, 2020 19:56

mackowski reviewed Mar 30, 2020

View reviewed changes

ThunderSon added the WAITING_UPDATE Reserved to PR: Indicates that the core team is waiting update from the author of the PR. label Apr 26, 2020

ThunderSon removed the WAITING_UPDATE Reserved to PR: Indicates that the core team is waiting update from the author of the PR. label Apr 29, 2020

mackowski requested review from jmanico and removed request for rbsec and ThunderSon July 29, 2020 07:39

Update Sensitive_Data_Storage_Cheat_Sheet.md

2f6d6d4

add suggested links to other cheatsheets, update ToC slightly add questions?

mackowski requested changes Aug 6, 2020

View reviewed changes

northdpole added 2 commits August 17, 2020 17:05

Update Sensitive_Data_Storage_Cheat_Sheet.md

5a1516e

address comments v1

Update Sensitive_Data_Storage_Cheat_Sheet.md

8f294c6

address comments v2

jmanico approved these changes Sep 17, 2020

View reviewed changes

mackowski requested changes Sep 17, 2020

View reviewed changes

mackowski closed this Mar 2, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Toc for Sensitive Data storage cheatsheet #377

Toc for Sensitive Data storage cheatsheet #377

northdpole commented Mar 28, 2020 •

edited

Loading

rbsec commented Mar 29, 2020

ThunderSon commented Mar 29, 2020

mackowski left a comment

ThunderSon commented Apr 26, 2020

northdpole commented Apr 26, 2020

ThunderSon commented Apr 29, 2020

mackowski commented Jul 29, 2020

northdpole commented Aug 4, 2020 via email

mackowski commented Aug 5, 2020

northdpole commented Aug 5, 2020

mackowski Aug 6, 2020

northdpole Aug 17, 2020

mackowski Aug 6, 2020

northdpole Aug 17, 2020

mackowski commented Aug 18, 2020

jmanico commented Aug 18, 2020 •

edited

Loading

mackowski left a comment

mackowski commented Sep 23, 2020

mackowski commented Nov 16, 2020

mackowski commented Mar 2, 2021

Toc for Sensitive Data storage cheatsheet #377

Toc for Sensitive Data storage cheatsheet #377

Conversation

northdpole commented Mar 28, 2020 • edited Loading

rbsec commented Mar 29, 2020

ThunderSon commented Mar 29, 2020

mackowski left a comment

Choose a reason for hiding this comment

ThunderSon commented Apr 26, 2020

northdpole commented Apr 26, 2020

ThunderSon commented Apr 29, 2020

mackowski commented Jul 29, 2020

northdpole commented Aug 4, 2020 via email

mackowski commented Aug 5, 2020

northdpole commented Aug 5, 2020

mackowski Aug 6, 2020

Choose a reason for hiding this comment

northdpole Aug 17, 2020

Choose a reason for hiding this comment

mackowski Aug 6, 2020

Choose a reason for hiding this comment

northdpole Aug 17, 2020

Choose a reason for hiding this comment

mackowski commented Aug 18, 2020

jmanico commented Aug 18, 2020 • edited Loading

mackowski left a comment

Choose a reason for hiding this comment

mackowski commented Sep 23, 2020

mackowski commented Nov 16, 2020

mackowski commented Mar 2, 2021

northdpole commented Mar 28, 2020 •

edited

Loading

jmanico commented Aug 18, 2020 •

edited

Loading