OWASP IoT Top 10

This skill encodes the OWASP IoT Top 10 for secure IoT device and ecosystem design and review. References are loaded per risk. Based on OWASP IoT Top 10 2018.

When to Read Which Reference

Risk	Read
I1 Weak, Guessable, or Hardcoded Passwords	references/i1-weak-passwords.md
I2 Insecure Network Services	references/i2-insecure-network-services.md
I3 Insecure Ecosystem Interfaces	references/i3-insecure-ecosystem-interfaces.md
I4 Lack of Secure Update Mechanism	references/i4-secure-update-mechanism.md
I5 Using Insecure or Outdated Components	references/i5-outdated-components.md
I6 Insecure Data Transfer and Storage	references/i6-insecure-data-transfer-storage.md
I7 Absence of Device Management	references/i7-device-management.md
I8 Insecure Default Settings	references/i8-insecure-default-settings.md
I9 Lack of Physical Hardening	references/i9-physical-hardening.md
I10 Insufficient Privacy Protection	references/i10-privacy-protection.md

Quick Patterns

• Eliminate default/hardcoded passwords; use secure update with signing; minimize exposed network services. Encrypt data in transit and at rest; support device lifecycle and decommissioning. Harden physically and protect user privacy.

Quick Reference / Examples

Task	Approach
Eliminate default passwords	Force password change on first use; generate unique per-device. See I1.
Secure updates	Sign firmware, verify before install, support rollback. See I4.
Minimize attack surface	Disable unused services, close unnecessary ports. See I2.
Encrypt data	TLS for transit, AES for storage, secure key storage. See I6.
Physical hardening	Disable debug interfaces (JTAG/UART), tamper detection. See I9.

Safe - firmware signature verification (pseudocode):

bool verify_firmware(uint8_t* firmware, size_t len, uint8_t* signature) {
    // Verify Ed25519 signature with embedded public key
    return ed25519_verify(signature, firmware, len, VENDOR_PUBLIC_KEY);
}
// Only install if verify_firmware() returns true

Unsafe - no update verification:

void install_firmware(uint8_t* firmware) {
    flash_write(firmware);  // No signature check - accepts malicious updates
}

Unique per-device credentials (manufacturing):

# During manufacturing, generate and store unique credentials
device_password = secrets.token_urlsafe(16)
store_in_secure_element(device_id, device_password)

Workflow

Load the reference for the risk you are addressing. See OWASP IoT Top 10 for the official list.