OWASP IoT and Embedded Application Security
OWASP project resources for securing IoT, embedded, and connected medical devices.
Definition
The OWASP IoT Project (and the related OWASP Embedded Application Security Project and OWASP IoT Top 10) provides community-curated guidance, threat catalogs, and testing methodologies for connected and embedded devices - including connected medical devices. The IoT Top 10 enumerates the most prevalent IoT security weaknesses (weak/guessable passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, etc.).What this means in practice
OWASP IoT Top 10 is a useful prioritization aid for product security backlogs. The OWASP MASTG (Mobile Application Security Testing Guide) covers companion mobile apps that often ship with connected medical devices; the OWASP Application Security Verification Standard (ASVS) provides a tiered set of testable requirements.Examples
- A MedTech manufacturer uses the OWASP IoT Top 10 to identify and prioritize security vulnerabilities in their new smart infusion pump's firmware, focusing on preventing weak authentication and insecure network services.
- During a product security review, a team assesses the companion mobile app for a wearable diagnostic device using principles from the OWASP Mobile Application Security Testing Guide (MASTG) to ensure data protection.
- A security architect applies the OWASP Application Security Verification Standard (ASVS) to define tiered security requirements for a connected imaging system, verifying that critical components meet high assurance levels.
- •Treating the OWASP IoT Top 10 as the entirety of the threat model rather than a baseline checklist.
- •Skipping OWASP MASTG when the device ships with a companion mobile app.
Frequently asked questions
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsHands-on adversarial testing in which qualified independent testers attempt to exploit a device's security controls.
The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
Automated security testing - SAST analyzes source code at rest, DAST exercises a running application.
A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.
More in Cybersecurity
· Same categoryAAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.
Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient.
Where this term appears across MedTech Terms.
Latest in MedTech
Sources
3 sourcesEvery citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
- 1OWASP IoT ProjectTier 2 VerifiedOWASPowasp.org
- 2OWASP MASTGTier 2 VerifiedOWASPmas.owasp.org
- 3CISA - Healthcare and Public Health SectorTier 2 VerifiedCISAcisa.gov
Inline markers like [1] jump to the matching reference above.