Top 10 2014-I6 Insecure Cloud Interface - Revision history

Yunsoul at 06:37, 5 February 2016

2016-02-05T06:37:55Z

2015-12-01T23:02:09Z

2015-08-18T00:12:15Z

2015-02-09T22:49:18Z

2015-02-09T22:48:53Z

2015-02-09T22:46:29Z

2015-02-09T22:40:12Z

2015-02-09T22:39:15Z

2015-02-09T22:37:47Z

2015-02-05T21:55:39Z

@@ Line 37: / Line 37: @@
 # Ensuring credentials are not exposed over the internet
 # Implement two factor authentication if possible
 Please review the following tabs for more detail based on whether you are a [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Manufacturers Manufacturer], [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Developers Developer] or [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Consumers Consumer]

← Older revision		Revision as of 23:02, 1 December 2015
Line 1:		Line 1:
−	<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=~~Top_IoT_Vulnerabilities~~ Back To The Internet of Things Top 10]</center>	+	<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Top_10_IoT_Vulnerabilities__282014_29 Back To The Internet of Things Top 10]</center>

	{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}		{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}

← Older revision		Revision as of 00:12, 18 August 2015
Line 1:		Line 1:
−	<center>[https://www.owasp.org/index.php/~~OWASP_Internet_of_Things_Top_Ten_Project~~#tab=~~OWASP_Internet_of_Things_Top_10_for_2014~~ Back To The Internet of Things Top 10]</center>	+	<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Top_IoT_Vulnerabilities Back To The Internet of Things Top 10]</center>

	{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}		{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}

@@ Line 22: / Line 22: @@
 {{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=Is My Cloud Interface Secure?|position=firstLeft|year=2013|language=en}}
-Checking for a insecure Cloud Interface includes:
+Checking for a Insecure Cloud Interface includes:
 * Determining if the default username and password can be changed during initial product setup
 * Determining if a specific user account is locked out after 3 - 5 failed login attempts

@@ Line 22: / Line 22: @@
 {{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=Is My Cloud Interface Secure?|position=firstLeft|year=2013|language=en}}
-Checking for a secure Cloud Interface includes:
+Checking for a insecure Cloud Interface includes:
 * Determining if the default username and password can be changed during initial product setup
 * Determining if a specific user account is locked out after 3 - 5 failed login attempts

@@ Line 33: / Line 33: @@
 # Default passwords and ideally default usernames to be changed during initial setup
 # Ensuring user accounts can not be enumerated using functionality such as password reset mechanisms
-# Ensuring account lockout after an appropriate number of tries
+# Ensuring account lockout after 3- 5 failed login attempts
 # Ensuring the cloud-based web interface is not susceptible to XSS, SQLi or CSRF
 # Ensuring credentials are not exposed over the internet
 Please review the following tabs for more detail based on whether you are a [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Manufacturers Manufacturer], [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Developers Developer] or [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Consumers Consumer]

← Older revision		Revision as of 22:39, 9 February 2015
Line 55:		Line 55:
	{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}		{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}

		+	* [https://www.owasp.org/index.php/Top_10_2013-A1-Injection Top 10 2013-A1-Injection]
		+	* [https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS) Top 10 2013-A3-Cross-Site Scripting]
		+	* [https://www.owasp.org/index.php/Top_10_2013-A8-Cross-Site_Request_Forgery_(CSRF) Top 10 2013-A8-Cross-Site Request Forgery (CSRF)]
	{{Top_10_2010:SubSubsectionExternalReferencesTemplate}}		{{Top_10_2010:SubSubsectionExternalReferencesTemplate}}

@@ Line 26: / Line 26: @@
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Secure My Cloud Interface?|position=right|year=2013|language=en}}
 A secure cloud interface requires:
-# Default passwords and ideally default usernames to be changed during initial setup.
+# Default passwords and ideally default usernames to be changed during initial setup
-# Ensuring user accounts can not be enumerated using functionality such as password reset mechanisms.
+# Ensuring user accounts can not be enumerated using functionality such as password reset mechanisms
-# Ensuring account lockout after an appropriate number of tries.
+# Ensuring account lockout after an appropriate number of tries
-# Ensuring the cloud-based web interface is not susceptible to XSS, SQLi or CSRF.
+# Ensuring the cloud-based web interface is not susceptible to XSS, SQLi or CSRF
-# Ensuring credentials are not exposed while connected to wireless networks.
+# Ensuring credentials are not exposed over the internet
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=1|year=2013|language=en}}