[Threat Modelling] Review log messages to ensure that they don’t include any sensitive data

[tobiscr]

Description

Log output of the Compass Manager could include sensitive data which enables attackers to infiltrate the application. A code review has to be applied to ensure that no sensitive application data (e.g. tokens, passwords, personal data etc.) will be logged by our software.

AC:

• Review the log-output of the Compass Manager and ensure that no sensitive data will be disclosed.

Steps to exploit

Attacker reviews the log output, finds sensitive data and abuses it against us.

Risk assessment
Part of the Threat Modelling workshop from 2023-11-29.

Proposed mitigation

Review any log output of the application to ensure that no sensitive data can be disclosed as part of log messages.

[tobiscr]

Mural Board: https://app.mural.co/t/sap10/m/sap10/1701162989605/93d8a5cfd1937c1ed568d324926d51d6d4c96669?sender=u03d165e43fbc397bd7057627