Issue Details
Insecure Data Transfer and Storage
iot07 • Rank #7 in OWASP 2023
Explanation
IoT devices handle sensitive data including credentials, personal information, and operational data. Insecure transfer occurs through unencrypted protocols, weak encryption, or missing certificate validation. Insecure storage includes plaintext credentials, unencrypted databases, and exposed configuration files on device filesystems.
Remedy
Encrypt all sensitive data in transit using TLS 1.2+. Encrypt sensitive data at rest using strong encryption algorithms. Implement secure key management for cryptographic keys. Minimize data storage on devices and use secure cloud storage where possible.
| Year | Rank | Category |
|---|---|---|
| 2018 | #7 | iot07 - Insecure Data Transfer and Storage |
| 2022 | #7 | iot07 - Insufficient Device Management and Monitoring |