This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Top 10 2014-I5 Privacy Concerns"
From OWASP
Craig Smith (talk | contribs) |
|||
| (4 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
| − | <center>[https://www.owasp.org/index.php/ | + | <center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Top_10_IoT_Vulnerabilities__282014_29 Back To The Internet of Things Top 10]</center> |
{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013|language=en}} | {{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013|language=en}} | ||
| Line 27: | Line 27: | ||
* Personally identifiable information can be exposed when not properly encrypted while at rest on storage mediums and during transit over networks | * Personally identifiable information can be exposed when not properly encrypted while at rest on storage mediums and during transit over networks | ||
* Reviewing who has access to personal information that is collected | * Reviewing who has access to personal information that is collected | ||
| + | * Determining if data collected can be de-identified or anonymized | ||
| + | * Determining if data collected is beyond what is needed for proper operation of the device (Does the end-user have a choice for this data collection?) | ||
| + | * Determining if a data retention policy is in place | ||
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Prevent Privacy Concerns?|position=right|year=2013|language=en}} | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Prevent Privacy Concerns?|position=right|year=2013|language=en}} | ||
| Line 38: | Line 41: | ||
# Ensuring that retention limits are set for collected data | # Ensuring that retention limits are set for collected data | ||
# Ensuring that end-users are provided with "Notice and Choice" if data collected is more than what would be expected from the product | # Ensuring that end-users are provided with "Notice and Choice" if data collected is more than what would be expected from the product | ||
| + | # Ensuring the role based access control/authorization to the collected data/analyzed data is applied | ||
| + | # Ensuring that the analyzed data is de-identified | ||
Please review the following tabs for more detail based on whether you are a [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Manufacturers Manufacturer], [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Developers Developer] or [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Consumers Consumer] | Please review the following tabs for more detail based on whether you are a [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Manufacturers Manufacturer], [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Developers Developer] or [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Consumers Consumer] | ||
| Line 58: | Line 63: | ||
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}} | {{Top_10_2010:SubSubsectionOWASPReferencesTemplate}} | ||
| − | [https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure Top 10 2013-A6-Sensitive Data Exposure] | + | [https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure Top 10 2013-A6-Sensitive Data Exposure]<br> |
| + | [https://www.owasp.org/index.php/OWASP_Top_10_Privacy_Risks_Project Top 10 Privacy Risks Project] | ||
{{Top_10_2010:SubSubsectionExternalReferencesTemplate}} <br> | {{Top_10_2010:SubSubsectionExternalReferencesTemplate}} <br> | ||
[https://www.ftc.gov/tips-advice/business-center/guidance/careful-connections-building-security-internet-things FTC: Careful Connections: Building Security in the Internet of Things] | [https://www.ftc.gov/tips-advice/business-center/guidance/careful-connections-building-security-internet-things FTC: Careful Connections: Building Security in the Internet of Things] | ||
[https://www.ftc.gov/system/files/documents/reports/federal-trade-commission-staff-report-november-2013-workshop-entitled-internet-things-privacy/150127iotrpt.pdf FTC: Internet of Things, Privacy & Security in a Connected World] | [https://www.ftc.gov/system/files/documents/reports/federal-trade-commission-staff-report-november-2013-workshop-entitled-internet-things-privacy/150127iotrpt.pdf FTC: Internet of Things, Privacy & Security in a Connected World] | ||
Latest revision as of 13:59, 14 May 2018
| Threat Agents | Attack Vectors | Security Weakness | Technical Impacts | Business Impacts | |
|---|---|---|---|---|---|
| Application Specific | Exploitability AVERAGE |
Prevalence COMMON |
Detectability EASY |
Impact SEVERE |
Application / Business Specific |
| Consider anyone who has access to the device itself, the network the device is connected to, the mobile application and the cloud connection including external and internal users. | Attacker uses multiple vectors such as insufficient authentication, lack of transport encryption or insecure network services to view personal data which is not being properly protected or is being collected unnecessarily. Attack could come from external or internal users. | Privacy concerns generated by the collection of personal data in addition to the lack of proper protection of that data is prevalent. Privacy concerns are easy to discover by simply reviewing the data that is being collected as the user sets up and activates the device. Automated tools can also look for specific patterns of data that may indicate collection of personal data or other sensitive data. | Collection of personal data along with a lack of protection of that data can lead to compromise of a user's personal data. | Consider the business impact of personal data that is collected unnecessarily or isn't protected properly. Data could be stolen. Could your customers be harmed by having this personal data exposed? | |
|
Does My Device Present Privacy Concerns?
Checking for Privacy Concerns includes:
|
How Do I Prevent Privacy Concerns?
Minimizing privacy concerns requires:
Please review the following tabs for more detail based on whether you are a Manufacturer, Developer or Consumer |
|
Example Attack Scenarios
Scenario #1: Collection of personal data. Date of birth, home address, phone number, etc. Scenario #2: Collection of financial and/or health information. Credit card data and bank account information. In the cases above, exposure of any of the data examples could lead to identity theft or compromise of accounts.
|
References
OWASP Top 10 2013-A6-Sensitive Data Exposure External |
