IoT Security · 2018 edition
OWASP Top 10 for Internet of Things security, covering firmware vulnerabilities, insecure interfaces, and device authentication risks.
Official OWASP list| Rank | Risk | Summary | Details |
|---|---|---|---|
| 01 | Weak, Guessable, or Hardcoded Passwords | IoT devices ship with default, weak, or hardcoded credentials that enable unauthorized access. | Details |
| 02 | Insecure Network Services | Unnecessary or unprotected network services expose devices to remote exploitation. | Details |
| 03 | Insecure Ecosystem Interfaces | Insecure web, mobile, cloud, or API interfaces in the IoT ecosystem enable compromise of devices and data. | Details |
| 04 | Lack of Secure Update Mechanism | Missing or insecure firmware update mechanisms prevent patching of vulnerabilities and enable malicious update injection. | Details |
| 05 | Use of Insecure or Outdated Components | IoT devices ship with outdated libraries, operating systems, and components containing known vulnerabilities. | Details |
| 06 | Insufficient Privacy Protection | IoT devices collect, store, and transmit personal data without adequate privacy controls or user consent. | Details |
| 07 | Insecure Data Transfer and Storage | Sensitive data transmitted or stored without encryption is vulnerable to interception and unauthorized access. | Details |
| 08 | Lack of Device Management | Missing device management capabilities prevent security monitoring, configuration, and lifecycle management at scale. | Details |
| 09 | Insecure Default Settings | Devices ship with insecure default configurations that users rarely change, leaving them exposed to attack. | Details |
| 10 | Lack of Physical Hardening | Insufficient physical security controls allow attackers to tamper with devices, extract data, or modify firmware. | Details |
