View source for Top 10 2014-I5 Privacy Concerns

<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=OWASP_Internet_of_Things_Top_10_for_2014 Back To The Internet of Things Top 10]</center>

{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013|language=en}}
{{Top_10:SummaryTableTemplate|exploitability=2|prevalence=2|detectability=1|impact=1|year=2013|language=en}}
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2013}}
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider anyone who has access to the device itself, the network the device is connected to, the mobile application and the cloud connection including external and internal users.

</td>
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Attacker uses multiple vectors such as insufficient authentication, lack of transport encryption or insecure network services to view personal data which is not being properly protected or is being collected unnecessarily. Attack could come from external or internal users.

</td>
     <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Privacy concerns generated by the collection of personal data in addition to the lack of proper protection of that data is prevalent. Privacy concerns are easy to discover by simply reviewing the data that is being collected as the user sets up and activates the device. Automated tools can also look for specific patterns of data that may indicate collection of personal data or other sensitive data.

</td>
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Collection of personal data along with a lack of protection of that data can lead to compromise of a user's personal data.

</td>
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider the business impact of personal data that is collected unnecessarily or isn't protected properly. Data could be stolen.  Could your customers be harmed by having this personal data exposed?

</td>
{{Top_10_2010:SummaryTableEndTemplate|year=2013}}

{{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=Does My Device Present Privacy Concerns?|position=firstLeft|year=2013|language=en}}
Checking for Privacy Concerns includes:
* Identifying all data types that are being collected by the device, its mobile application and any cloud interfaces
* The device and it's various components should only collect what is necessary to perform its function
* Personally identifiable information can be exposed when not properly encrypted while at rest on storage mediums and during transit over networks
* Reviewing who has access to personal information that is collected

{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Prevent Privacy Concerns?|position=right|year=2013|language=en}}
Minimizing privacy concerns requires:
# Ensuring only data critical to the functionality of the device is collected
# Ensuring any data collected is properly protected with encryption
# Ensuring the device and all of its components properly protect personal information
# Ensuring only authorized individuals have access to collected personal information

Please review the following tabs for more detail based on whether you are a [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Manufacturers Manufacturer], [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Developers Developer] or [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Consumers Consumer]
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=1|year=2013|language=en}}
'''Scenario #1:''' Collection of personal data.

{{Top_10_2010:ExampleBeginTemplate|year=2013}}<span style="color:red;">
Date of birth, home address, phone number, etc.

</span>{{Top_10_2010:ExampleEndTemplate}}
'''Scenario #2:''' Collection of financial and/or health information.
{{Top_10_2010:ExampleBeginTemplate|year=2013}}<span style="color:red;">
Credit card data and bank account information.

</span>{{Top_10_2010:ExampleEndTemplate}}
In the cases above, exposure of any of the data examples could lead to identity theft or compromise of accounts.


{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=1|year=2013|language=en}}
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}

[https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure Top 10 2013-A6-Sensitive Data Exposure]
{{Top_10_2010:SubSubsectionExternalReferencesTemplate}}