Data files / database files found

Data files, database files, and data repositories should be kept out of regular disk mounts, source code, infrastructure repositories or any other unsafe storage.

Even if data files are encrypted, important information can be gleaned such as size of data, amount of records (depending on database or data format) and various other signals that can be used for social engineering, and other attacks.

Problem

We have found a visible/accessible data file, data repository or database file.

Fix

1. Use a dedicated mount or drive for data files that is highly monitored, audited, and inaccessible
2. Never include data in source code, repositories
3. Make sure to delete backup files, temporary files, test files, or demo data files that are checked in by mistake

See

• CWE-379 creation of temporary files