Testing for Missing Encryption of Sensitive Data