When security behavior is hardcoded, users and administrators cannot adapt devices to their environment or respond when a weakness is discovered.
Expose security settings to administrators, including password policy, encryption options, logging and alerting, and role separation.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2022Latest
#08iot08 Insecure Physical Security
No change since 20182018
#08iot08 Lack of Device Management
No change since 20142014
#08iot08-2014 Insufficient Security Configurability
