OWASP Internet of Things Top Ten Project - Revision history

Jmanico: removing this project and redirecting

2015-11-11T21:23:11Z

removing this project and redirecting

Show changes

Justin C. Klein Keane: Moving the community tab over to the project pages, where it seems more appropriate.

2015-10-23T17:31:18Z

Moving the community tab over to the project pages, where it seems more appropriate.

Justin C. Klein Keane: /* Developer IoT Security Guidance */ Added link to OWASP Periodic Table in framework discussion

2015-10-23T10:47:42Z

‎Developer IoT Security Guidance: Added link to OWASP Periodic Table in framework discussion

Justin C. Klein Keane: Updated community section to add a few other industry organizations (Industrial Internet Consortium, Online Trust Alliance, Securing Smart Cities, and removed IFTTT since it's a commercial company rather than a community)

2015-10-23T10:42:26Z

Updated community section to add a few other industry organizations (Industrial Internet Consortium, Online Trust Alliance, Securing Smart Cities, and removed IFTTT since it's a commercial company rather than a community)

Justin C. Klein Keane: /* Developer IoT Security Guidance */

2015-10-21T16:47:39Z

‎Developer IoT Security Guidance

Justin C. Klein Keane: /* Developer IoT Security Guidance */

2015-10-21T12:51:53Z

‎Developer IoT Security Guidance

Justin C. Klein Keane: /* Developer IoT Security Guidance */

2015-10-21T12:50:23Z

‎Developer IoT Security Guidance

Craig Smith at 20:35, 3 September 2015

2015-09-03T20:35:04Z

Craig Smith at 20:33, 3 September 2015

2015-09-03T20:33:54Z

Craig Smith at 00:01, 12 August 2015

2015-08-12T00:01:20Z

← Older revision		Revision as of 17:31, 23 October 2015
Line 141:		Line 141:
	{{Template:OWASP OWASP_Top10 Project}} -->		{{Template:OWASP OWASP_Top10 Project}} -->

−	~~= Community =~~

−	~~[https://www.iamthecavalry.org/ I Am The Cavalry]~~
−
−	~~A global grassroots organization that is focused on issues where computer security intersects public safety and human life.~~
−
−	~~Their areas of focus include:~~
−	* Medical devices
−	* Automobiles
−	* Home Electronics
−	* Public Infrastructure
−	~~== ==~~
−	~~[http://builditsecure.ly BuildItSecure.ly]~~
−
−	~~A project focused on helping small business connect with security researchers to aid in securing their IoT-based products before going market.~~
−
−	~~Their goals include:~~
−	* Focus effort towards small business
−	* Build partnerships
−	* Coordinate efforts
−	* Curate informational resources
−	* Present research
−	~~== ==~~
−	~~[https://otalliance.org Online Trust Alliance]~~
−
−	Formed as an informal industry working group in 2005, today OTA is an Internal Revenue Service (IRS) approved 501c3 charitable organization with the mission to enhance online trust and empower users, while promoting innovation and the vitality of the internet. OTA is global organization supported by over 100 organizations headquartered in Bellevue, Washington with offices in Washington DC.
−
−	Addressing the mounting concerns, in January 2015 the Online Trust Alliance, established the [https://otalliance.org/initiatives/internet-things IoT Trustworthy Working Group (ITWG)], a multi-stakeholder initiative. The group recognizes “security and privacy by design” must be a priority from the onset of product development and be addressed holistically. The framework focuses on privacy, security sustainability. The sustainability pillar is critical as it looks at the life-cycle issues related to long- term supportability and transfers of ownership of devices and the data collected.
−	~~== ==~~
−	~~[https://allseenalliance.org/framework AllSeen Alliance]~~
−
−	The AllSeen Alliance is a Linux Foundation collaborative project. They're a cross-industry consortium dedicated to enabling the interoperability of billions of devices, services and apps that comprise the Internet of Things. The Alliance supports the AllJoyn Framework, an open source software framework that makes it easy for devices and apps to discover and communicate with each other. Developers can write applications for interoperability regardless of transport layer, manufacturer, and without the need for Internet access. The software has been and will continue to be openly available for developers to download, and runs on popular platforms such as Linux and Linux-based Android, iOS, and Windows, including many other lightweight real-time operating systems.
−	~~== ==~~
−	~~[http://www.iiconsortium.org/ The Industrial Internet Consortium (IIC)]~~
−
−	The Industrial Internet Consortium is the open membership, international not-for-profit consortium that is setting the architectural framework and direction for the Industrial Internet. Founded by AT&T, Cisco, GE, IBM and Intel in March 2014, the consortium’s mission is to coordinate vast ecosystem initiatives to connect and integrate objects with people, processes and data using common architectures, interoperability and open standards.
−	~~== ==~~
−	~~[http://securingsmartcities.org/ Securing Smart Cities]~~
−
−	Securing Smart Cities is a not-for-profit global initiative that aims to solve the existing and future cybersecurity problems of smart cities through collaboration between companies, governments, media outlets, other not-for-profit initiatives and individuals across the world.
	= Manufacturers =		= Manufacturers =

@@ Line 313: / Line 313: @@
 * Consider the use of web application firewalls to protect any web interfaces
+|
-When building a web interface consider implementing lessons learned from web application security.  Employ a framework that utilizes security controls to ensure that vulnerabilities are mitigated in code.  Be sure to plan for eventual upgrades or security fixes to the framework as well.  If you use optional plugins to the framework be sure to review them for security.
+When building a web interface consider implementing lessons learned from web application security.  Employ a [https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities#Generic_Application_Frameworks framework] that utilizes security controls to ensure that vulnerabilities are mitigated in code.  Be sure to plan for eventual upgrades or security fixes to the framework as well.  If you use optional plugins to the framework be sure to review them for security.
 Deploy and protect the web interface in the same way you would any web application.  Utilize encrypted transport protocols if possible, being sure to validate certificates.  Limit access in whatever ways possible.  Assume users will not change configuration so deploy in a secure manner with strong credentials already in place.

@@ Line 152: / Line 152: @@
 * Home Electronics
 * Public Infrastructure
 == ==
 [http://builditsecure.ly BuildItSecure.ly]
@@ Line 171: / Line 163: @@
 * Curate informational resources
 * Present research
 = Manufacturers =

@@ Line 304: / Line 304: @@
 * Consider the use of web application firewalls to protect any web interfaces
+|
-When building a web interface consider implementing lessons learned from web application security.  Employ a framework that utilizes security controls to ensure that vulnerabilities are mitigated in code.  Be sure to plan for eventual upgrades or security fixes to the framework as well.  If you use optional plugins to the framework be sure to review them for security as well.
+When building a web interface consider implementing lessons learned from web application security.  Employ a framework that utilizes security controls to ensure that vulnerabilities are mitigated in code.  Be sure to plan for eventual upgrades or security fixes to the framework as well.  If you use optional plugins to the framework be sure to review them for security.
 Deploy and protect the web interface in the same way you would any web application.  Utilize encrypted transport protocols if possible, being sure to validate certificates.  Limit access in whatever ways possible.  Assume users will not change configuration so deploy in a secure manner with strong credentials already in place.

@@ Line 378: / Line 378: @@
 * Ensure all applications are written to produce alerts and notifications to the user for security events
+|
-Security can be a value proposition.  Design should take into consideration a sliding scale of security requirements.  Architect project with secure defaults and allow consumers to select options to be enabled or disabled.  IoT design should be forward compatibile with respect to security - as cipher suites increase and new security technologies become widely available IoT design should be able to adopt these new technologies.
+Security can be a value proposition.  Design should take into consideration a sliding scale of security requirements.  Architect projects with secure defaults and allow consumers to select options to be enabled or disabled.  IoT design should be forward compatible with respect to security - as cipher suites increase and new security technologies become widely available IoT design should be able to adopt these new technologies.
 Remember the security lifecycle of protect, detect, and react.  Design systems to allow for the detection of malicious activity as well as self defending capabilities and a reaction plan should a compromise be detected.  Design all stages of the lifecycle to be evolutionary so improvements can be added to a system or device future releases, updates, or patches.

@@ Line 290: / Line 290: @@
 The goal of this page is help developers build more secure applications in the Internet of Things space. The guidance below is at a basic level, giving developers of applications a basic set of guidelines to consider from their perspective. This is not a comprehensive list of considerations, and should not be treated as such, but ensuring that these fundamentals are covered will greatly improve the security of any IoT product.
-{| border="1" class="wikitable" style="text-align: left"
+{| border="1" class="wikitable" style="text-align:left;"
 ! Category
 ! IoT Security Consideration
-|-
+! Recommendations
 | '''I1: Insecure Web Interface'''
+|
@@ Line 302: / Line 303: @@
 * Ensure that any web interface coding is written to allow the owner to change the username and password
 * Consider the use of web application firewalls to protect any web interfaces
 |-
 | '''I2: Insufficient Authentication/Authorization'''
+|
@@ Line 312: / Line 317: @@
 * Ensure that applications are written to include the option to force password expiration after a specific period
 * Ensure that applications are written to include the option to change the default username and password
 |-
 | '''I3: Insecure Network Services'''
+|
 * Ensure applications that use network services don't respond poorly to buffer overflow, fuzzing or denial of service attacks
 * Ensure applications test ports are taken out of service before going to production
 |-
 | '''I4: Lack of Transport Encryption'''
+|
@@ Line 323: / Line 332: @@
 * Use recommended and accepted encryption practices and avoid proprietary protocols
 * Consider making a firewall option available for the application
 |-
 | '''I5: Privacy Concerns'''
+|
@@ Line 330: / Line 341: @@
 * Ensuring data is de-identified or anonymized
 * Ensuring end-users are given a choice for data collected beyond what is needed for proper operation of the device
 |-
 | '''I6: Insecure Cloud Interface'''
+|
@@ Line 342: / Line 355: @@
 * Ensure that cloud interfaces are written to include the option to force password expiration after a specific period
 * Ensure that cloud interfaces are written to include the option to change the default username and password
 |-
 | '''I7: Insecure Mobile Interface'''
+|
@@ Line 353: / Line 368: @@
 * Ensure that mobile interfaces are written to include the option to change the default username and password
 * Ensure that mobile interfaces only collect the minimum amount of personal information needed
 |-
 | '''I8: Insufficient Security Configurability'''
+|
@@ Line 360: / Line 377: @@
 * Ensure all applications are written to produce logs for security events
 * Ensure all applications are written to produce alerts and notifications to the user for security events
 |-
 | '''I9: Insecure Software/Firmware'''
+|
@@ Line 366: / Line 387: @@
 * Ensure all applications are written to process encrypted update files and that the files are transmitted using encryption
 * Ensure all applications are written to process signed files and then validate that file before installation
-|-
+Provide a mechanism for issuing, updating and revoking cryptographic keys as well.  Key management and lifecycle should be taken into consideration prior to deployment.  This includes the SSL trust store, or root trust, on a device, which may have to be modified over the lifespan of the device.
 | '''I10: Poor Physical Security'''
+|
@@ Line 374: / Line 402: @@
 * Ensure all applications are written to allow for disabling of unused physical ports such as USB
 * Consider writing applications to limit administrative capabilities to a local interface only
 |}
@@ Line 383: / Line 417: @@
 ** Ensuring strong passwords are required by users
 ** Implementing account lockout after 3 - 5 failed login attempts
 [ NOTE: Given the fact that each deployment and every environment is different, it is important to weigh the pros and cons of implementing the advice above before taking each step. ]
 = Testers =

@@ Line 66: / Line 66: @@
 == Quick Download ==
-[https://drive.google.com/file/d/0B52IUvO0LP6ON2VzZVFkNGF6aVE/view?usp=sharing OWASP Internet of Things Top Ten 2014 PDF]
+[https://www.owasp.org/images/3/36/IoTTestingMethodology.pdf IoT Attack Surface Mapping DEFCON 23]
-[https://drive.google.com/file/d/0B52IUvO0LP6OYVoweHNBeVFDdGs/view?usp=sharing OWASP Internet of Things Top Ten 2014 Infographic]
+[https://www.owasp.org/images/2/2d/Iot_testing_methodology.JPG IoT Testing Guidance Handout]
-[https://drive.google.com/file/d/0B52IUvO0LP6OUGVWeGZGdnhleFU/view?usp=sharing OWASP Internet of Things Top Ten 2014 PPT]
+[https://www.owasp.org/images/7/71/Internet_of_Things_Top_Ten_2014-OWASP.pdf OWASP IoT Top Ten PDF]
-[https://drive.google.com/file/d/0B52IUvO0LP6OdW1HMjRpM3VVUVE/view?usp=sharing OWASP IoT Top Ten RSA 2015 Presentation]
+[https://www.owasp.org/images/8/8e/Infographic-v1.jpg OWASP IoT Top Ten Infographic]
 == News and Events ==
-* [April 2015] Added the IoT Top 10 talk from RSA
+* Daniel Miessler gave his IoT talk at DEFCON 23
-* [April 2015] Added an IoT Top 10 Infographic
+* Migrating the IoT Top Ten to be under the IoT Project
 ==Classifications==

@@ Line 138: / Line 138: @@
 <!-- ==== Project Identification ====
 {{Template:OWASP OWASP_Top10 Project}} -->
 = Community =

← Older revision		Revision as of 00:01, 12 August 2015
Line 4:		Line 4:


−	== '''NOTE''': This project is ~~being renamed to~~ [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project The ~~Internet of Things~~ Project], which is located [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project here]. ~~Please use that project instead. This version will be retired on January 1st, 2016…~~ ==	+	== '''NOTE''': This project is part of [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project The OWASP IoT Project], which is located [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Main here]. ==

	{\| style="padding: 0;margin:0;margin-top:10px;text-align:left;" \|-		{\| style="padding: 0;margin:0;margin-top:10px;text-align:left;" \|-