Top 10-2017 A8-Insecure Deserialization , why products does not implement encryption On trying to understand Deserialization vulnerability, it was observed that serialization is the process of converting a complex object to a byte stream for sending it across networks and is deserialized on the receiver side. 

On analysing OWASP TOP A8, it says the IT industry has an high prevalence of this feature being compromised for exploitation. 

Question:

Why are products not encrypting the serialized data as discussed in the post below?

Which is better: “serialize and then encrypt” or “encrypt and then serialize”?
Why are products not encrypting the serialized data as discussed in [#30723]? 


Because encryption by itself does not reliably prevent alteration of the data, which is the vulnerability here. As Maarten Bodewes comments in that very Q.

To prevent tampering in general you need -- as OWASP says -- an integrity check, like a MAC or signature. Not encryption. (Although if you have authenticated encryption, which does both encryption and MAC as a combined operation, and in recent years has become more popular and widely available, you might as well use it.)

Now, why don't/didn't people use a MAC or signature (or AE) on data which if altered can be dangerous? That's a good question. To which I don't have a good answer.