ASVS 5.0 V11.7.2 (Level 3) requires data minimization during processing: expose only the minimum data needed, and encrypt it again immediately after use or as soon as feasible.
Why it matters
Every plaintext copy is a target. Long lived plaintext in memory, caches, logs and temporary files widens the window in which a bug, a core dump or an insider can reach it.
How to implement it
Shrink what you decrypt and how long you hold it.
- Decrypt one field, not the whole record.
- Pass tokens or references between services instead of raw values.
- Keep plaintext in a short scope and clear it after use.
- Keep it out of logs, caches and error reports.
def with_card(vault, token, fn):
pan = vault.reveal(token) # decrypt only here
try:
return fn(pan)
finally:
pan = None # drop the reference promptly
Language runtimes do not guarantee wiping memory, so combine this with minimising scope, and with memory protection from V11.7.1 for the most sensitive cases.
How to test it
Trace a sensitive field through one request. List each place it is plaintext, and for how long. Check logs and crash dumps for the value. Fewer places and shorter spans on the next review means progress.
Common mistakes
- Decrypting a full database row to read one column
- Caching decrypted values for speed
- Logging request bodies that contain secrets
Quick check
What two ideas does V11.7.2 combine?
Expose minimal data while processing, and re encrypt as soon as feasible.
