IOT Developer Security Checklist
simplesecurity.sensedeep.com
IOT Developer Security Checklist
1–10 of 36 posts
Re: IOT Developer Security Checklist
#2I feel like the first two items on this list should be:
- does this really need to be online?
- really?
Re: IOT Developer Security Checklist
#3The guidelines appear rather rudimentary. It is a sad state of affairs that IoT developers need these.
Re: IOT Developer Security Checklist
#4Maybe I'm missing something, but is the general consensus on HTTP Auth that it's poor security? I've seen is suggested a lot of (e.g.) authentication in webapp api scenarios. Specifically to use it to pass the initial username/password, and then stuff an session token into it (after login). What are the added security risks of this (so long as it's done over HTTPS)?
Re: IOT Developer Security Checklist
#5The guidelines appear rather rudimentary. It is a sad state of affairs that IoT developers need these.
I know, it is a very sad state of affairs.
In doing IOT for 2 decades, this is probably one of the biggest issues. At best, most devices have a "download firmware" option that 99% of users can't operate.
I could go on about dozens of other issues, like back-door field-service passwords, http not https, passwords in the clear, endless XSS vulnerabilities, but this is one of the biggest.
Re: IOT Developer Security Checklist
#6I feel like the first two items on this list should be: - does this really need to be online? - really ?
I like to use the XYZ metric. (aka: eXamine Your Zipper)
1. Does the zipper on the fly of
your pants need to be automated?
2. Does the zipper on the fly of
your pants ever need costly repairs?
3. Does the zipper on the fly of
your pants need regular maintenance?
4. Does the zipper on the fly of
your pants expend disposable accessories?
5. Does the zipper on the fly of
your pants need to be context aware?
6. Does the zipper on the fly of
your pants require internet connectivity?
7. Should the zipper on the fly of
your pants be controllable via cell phone app?
8. Should the zipper on the fly of
your pants monetize potential advertising space?
9. Should the zipper on the fly of
your pants collect behavioral analytics?
10. Should the zipper on the fly of
your pants enforce DRM policies?
Re: IOT Developer Security Checklist
#7Maybe I'm missing something, but is the general consensus on HTTP Auth that it's poor security? I've seen is suggested a lot of (e.g.) authentication in webapp api scenarios. Specifically to use it to pass the initial username/password, and then stuff an session token into it (after login). What are the added security risks of this (so long as it's done over HTTPS)?
Do you mean basic & digest http auth built into the browsers? If so, yes, they are bad. The issue is you cannot reliably implement log off on all browsers.
Re: IOT Developer Security Checklist
#8Beginner question: what about if the device doesn't accept over the air updates? What sort of security concerns are there for such a device that wakes up periodically to send data over HTTP.
Re: IOT Developer Security Checklist
#9Beginner question: what about if the device doesn't accept over the air updates? What sort of security concerns are there for such a device that wakes up periodically to send data over HTTP.
If the device does not listen, i.e. it calls out, then it is inherently much more secure. However, many devices use an embedded web server and do listen for requests.
If the device does not listen, and polls regularly for updates, then that is fine ... perhaps even ideal.
Re: IOT Developer Security Checklist
#10I feel like the first two items on this list should be: - does this really need to be online? - really ?
I know! Why do device manufacturers need to be pushed for this? We consumers keep buying stuff that has been put on the internet with little to no thought about security today or tomorrow.
IOT will get much worse before it gets better. I say this from working with device builders for 2 decades. The level of attention to security is sadly lacking.