risk
Weak or absent encryption and key management
Sensitive data stored or transmitted without adequate encryption, or use of weak/flawed cryptography and poor key generation, storage, rotation, and destruction — enabling interception, disclosure, or tampering of data.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- category
- cyber_security
- domain
- Cryptography & Key Management
- Data Protection & Privacy
- Network & Communications Security
- taxonomy
- iso-27005-vulnerability
- nist-800-30-threat-event
- nist-privacy-risk
- inherent_rating
- high
Details
- risk_id
- crypto-weak-or-absent-encryption
- category
- cyber_security
- likelihood
- medium
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- iso-27005-vulnerability
- nist-800-30-threat-event
- nist-privacy-risk
Source
No record-specific source URL is provided.
Connections
- UC-CRYPTO-04 — Protect data in use from unauthorized access mitigates Weak or absent encryption and key management
- strength
- primary
- rationale
- protecting data in use (memory/session encryption, enclaves) extends cryptographic coverage to active data, closing the residual exposure that at-rest/in-transit encryption leaves open
- UC-NET-02 — Authorize and secure remote, wireless, and mobile access mitigates Weak or absent encryption and key management
- strength
- related
- rationale
- Mandating encryption for remote/wireless/mobile transmission reduces unencrypted-in-transit exposure; storage and key management addressed elsewhere.
- UC-CRYPTO-01 — Encrypt data at rest and in transit mitigates Weak or absent encryption and key management
- strength
- primary
- rationale
- Renders data at rest unreadable and encrypts data in transit with strong cryptography, directly closing the absent/inadequate-encryption exposure for stored and transmitted data.
- UC-CRYPTO-02 — Use approved algorithms and validated cryptographic modules mitigates Weak or absent encryption and key management
- strength
- primary
- rationale
- Mandates approved algorithms/key lengths and independently validated modules while banning deprecated primitives (SSL/early TLS, SHA-1, RSA<2048), directly eliminating weak/flawed cryptography and poor key generation.
- UC-CRYPTO-03 — Manage cryptographic keys and certificates across their lifecycle mitigates Weak or absent encryption and key management
- strength
- primary
- rationale
- Governs key generation, HSM storage, rotation, and destruction under dual control, directly remediating the poor-key-management facet that weakens encryption.