This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Top 10 2014-I5 Privacy Concerns
From OWASP
Revision as of 00:54, 19 June 2014 by Craig Smith (talk | contribs)
| Threat Agents | Attack Vectors | Security Weakness | Technical Impacts | Business Impacts | |
|---|---|---|---|---|---|
| Application Specific | Exploitability EASY |
Prevalence COMMON |
Detectability AVERAGE |
Impact SEVERE |
Application / Business Specific |
| Consider anyone who has access to the device itself, the network the device is connected to, the mobile application and the cloud connection including external and internal users. | Attacker uses multiple vectors such as insufficient authentication, lack of transport encryption or insecure network services to view personal data which is being properly protected or is being collected unnecessarily. Depending on setup, attack could come from external or internal users. | Privacy concerns generated by the collection of personal data in addition to the lack proper protection of that data is prevalent. Privacy concerns are easy to discover by simply reviewing the data that is being collected as on sets up and activates these devices. Automated tools can also look for specific patterns of data that may indicate collection of personal data. | Collection of personal data along with a lack of protection of that data can lead to compromise of a user's personal data. | Consider the business impact of personal data that is collected unnecessarily or isn't protected properly. Data could be stolen or modified. Could your users be harmed by having their personal data exposed? | |
|
Does My Device Present Privacy Concerns?
TEXT |
How Do I Use Prevent Privacy Concerns?
Ensuring sufficient authentication/authorization requires:
|
|
Example Attack Scenarios
Scenario #1: The interface only requires simple passwords. Example Scenario #2: Username and password are poorly protected when transmitted over the network. Example In the cases above, the attacker is able to either easily guess the password or is able to capture the credentials as they cross the network and decode it since the credentials are only protected using Base64 Encoding.
|
References
OWASP External |
