Top 10 2014-I4 Lack of Transport Encryption - Revision history

Yunsoul at 06:08, 5 February 2016

2016-02-05T06:08:44Z

Craig Smith at 23:01, 1 December 2015

2015-12-01T23:01:35Z

Craig Smith at 00:11, 18 August 2015

2015-08-18T00:11:35Z

Craig Smith at 22:06, 9 February 2015

2015-02-09T22:06:46Z

Craig Smith at 20:34, 29 June 2014

2014-06-29T20:34:15Z

Craig Smith at 20:31, 29 June 2014

2014-06-29T20:31:16Z

Craig Smith at 20:29, 29 June 2014

2014-06-29T20:29:05Z

Craig Smith at 20:27, 29 June 2014

2014-06-29T20:27:11Z

Craig Smith at 20:23, 29 June 2014

2014-06-29T20:23:57Z

Craig Smith at 20:22, 29 June 2014

2014-06-29T20:22:41Z

@@ Line 32: / Line 32: @@
 # Ensuring other industry standard encryption techniques are utilized to protect data during transport if SSL or TLS are not available.
 # Ensuring only accepted encryption standards are used and avoid using proprietary encryption protocols
 Please review the following tabs for more detail based on whether you are a [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Manufacturers Manufacturer], [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Developers Developer] or [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Consumers Consumer]

← Older revision		Revision as of 23:01, 1 December 2015
Line 1:		Line 1:
−	<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=~~Top_IoT_Vulnerabilities~~ Back To The Internet of Things Top 10]</center>	+	<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Top_10_IoT_Vulnerabilities__282014_29 Back To The Internet of Things Top 10]</center>

	{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}		{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}

← Older revision		Revision as of 00:11, 18 August 2015
Line 1:		Line 1:
−	<center>[https://www.owasp.org/index.php/~~OWASP_Internet_of_Things_Top_Ten_Project~~#tab=~~OWASP_Internet_of_Things_Top_10_for_2014~~ Back To The Internet of Things Top 10]</center>	+	<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Top_IoT_Vulnerabilities Back To The Internet of Things Top 10]</center>

	{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}		{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}

@@ Line 22: / Line 22: @@
 {{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=Do I Use Transport Encryption?|position=firstLeft|year=2013|language=en}}
-Determining if the device uses transport encryption is fairly straightforward by reviewing network traffic of the device, its mobile application and any cloud connections to determine if any data is passed in the clear. The use or lack of use of SSL or TLS can also be reviewed to ensure it is in use and properly implemented.
+Checking for Lack of Transport Encryption includes:
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Use Transport Encryption?|position=right|year=2013|language=en}}
@@ Line 28: / Line 31: @@
 # Ensuring data is encrypted using protocols such as SSL and TLS while transiting networks.
 # Ensuring other industry standard encryption techniques are utilized to protect data during transport if SSL or TLS are not available.
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=1|year=2013|language=en}}
 '''Scenario #1:''' The cloud interface uses only HTTP.
@@ Line 47: / Line 52: @@
 {{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
 {{Top_10_2010:SubSubsectionExternalReferencesTemplate}}

@@ Line 22: / Line 22: @@
 {{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=Do I Use Transport Encryption?|position=firstLeft|year=2013|language=en}}
-Determining if the device uses transport encryption is fairly straightforward by reviewing network traffic of the device, its mobile application and any cloud connections to determine if any data is passed in the clear. The use of SSL or TLS can also be reviewed to ensure it is in use and properly implemented.
+Determining if the device uses transport encryption is fairly straightforward by reviewing network traffic of the device, its mobile application and any cloud connections to determine if any data is passed in the clear. The use or lack of use of SSL or TLS can also be reviewed to ensure it is in use and properly implemented.
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Use Transport Encryption?|position=right|year=2013|language=en}}

@@ Line 13: / Line 13: @@
 </td>
-      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Lack of transport encryption can result in data loss or corruption and and can lead to complete compromise of the device or user accounts.
+      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Lack of transport encryption can result in data loss and depending on the data exposed, could lead to complete compromise of the device or user accounts.
 </td>

@@ Line 10: / Line 10: @@
 </td>
-      <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Lack of transport encryption allows data to be viewed as it travels over local networks or the internet. Lack of transport encryption is prevalent on local networks as it is easy to assume that local network traffic will not make its way out to the internet, however in the case of a local wireless network, misconfiguration of that wireless network can make traffic visible to anyone within range of that wireless network. Many Issues with transport encryption are easy to discover simply by viewing network traffic and searching for readable data. Automated tools can also look for implementation of common transport encryption such as SSL and TLS.
+      <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Lack of transport encryption allows data to be viewed as it travels over local networks or the internet. Lack of transport encryption is prevalent on local networks as it is easy to assume that local network traffic will not be widely visible, however in the case of a local wireless network, misconfiguration of that wireless network can make traffic visible to anyone within range of that wireless network. Many Issues with transport encryption are easy to discover simply by viewing network traffic and searching for readable data. Automated tools can also look for proper implementation of common transport encryption such as SSL and TLS.
 </td>

@@ Line 2: / Line 2: @@
 {{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013|language=en}}
-{{Top_10:SummaryTableTemplate|exploitability=2|prevalence=2|detectability=2|impact=1|year=2013|language=en}}
+{{Top_10:SummaryTableTemplate|exploitability=2|prevalence=2|detectability=1|impact=1|year=2013|language=en}}
 {{Top_10_2010:SummaryTableHeaderEndTemplate|year=2013}}
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider anyone who has access to the network the device is connected to, including external and internal users.