--- title: "OWASP IoT and Embedded Application Security… | MedTech Terms" description: "OWASP project resources for securing IoT, embedded, and connected medical devices. Plain-English Cybersecurity definition for MedTech teams, with examples and r" lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/owasp-iot#term", "name": "OWASP IoT and Embedded Application Security", "description": "The OWASP IoT Project (and the related OWASP Embedded Application Security Project and OWASP IoT Top 10) provides community-curated guidance, threat catalogs, and testing methodologies for connected and embedded devices - including connected medical devices. The IoT Top 10 enumerates the most prevalent IoT security weaknesses (weak/guessable passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, etc.).", "url": "https://medtechterms.com/terms/owasp-iot", "termCode": "owasp-iot", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/owasp-iot#article", "headline": "OWASP IoT and Embedded Application Security", "description": "OWASP project resources for securing IoT, embedded, and connected medical devices.", "url": "https://medtechterms.com/terms/owasp-iot", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/owasp-iot" }, "about": { "@id": "https://medtechterms.com/terms/owasp-iot#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "OWASP IoT and Embedded Application Security, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "OWASP IoT Project", "url": "https://owasp.org/www-project-internet-of-things/", "publisher": { "@type": "Organization", "name": "OWASP" } }, { "@type": "CreativeWork", "name": "OWASP MASTG", "url": "https://mas.owasp.org/MASTG/", "publisher": { "@type": "Organization", "name": "OWASP" } }, { "@type": "CreativeWork", "name": "CISA - Healthcare and Public Health Sector", "url": "https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector", "publisher": { "@type": "Organization", "name": "CISA" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/pen-test#term", "name": "Penetration Testing", "url": "https://medtechterms.com/terms/pen-test" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/sast-dast#term", "name": "SAST and DAST", "url": "https://medtechterms.com/terms/sast-dast" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/threat-modeling#term", "name": "Threat Modeling", "url": "https://medtechterms.com/terms/threat-modeling" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "OWASP IoT and Embedded Application Security", "item": "https://medtechterms.com/terms/owasp-iot" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/owasp-iot#faq", "mainEntity": [ { "@type": "Question", "name": "Is OWASP a standard?", "acceptedAnswer": { "@type": "Answer", "text": "OWASP is an open community that produces guidance, methodologies, and tooling. ASVS and MASVS are the closest to formal verification standards; the IoT Top 10 is a prioritization list." } }, { "@type": "Question", "name": "How does OWASP IoT Top 10 differ from CWE Top 25?", "acceptedAnswer": { "@type": "Answer", "text": "OWASP IoT Top 10 is IoT-specific and operationally framed (e.g., 'lack of secure update mechanism'). CWE Top 25 is a code-weakness taxonomy (e.g., CWE-78 OS command injection). Both are useful at different layers." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. OWASP IoT and Embedded Application Security [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) # OWASP IoT and Embedded Application Security OWASP project resources for securing IoT, embedded, and connected medical devices. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition The OWASP IoT Project (and the related OWASP Embedded Application Security Project and OWASP IoT Top 10) provides community-curated guidance, threat catalogs, and testing methodologies for connected and embedded devices - including connected medical devices. The IoT Top 10 enumerates the most prevalent IoT security weaknesses (weak/guessable passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, etc.). What the regulation says OWASP resources are not regulatory but are widely cited across MedTech security practice. FDA, [IMDRF](/terms/imdrf), and the HSCC reference OWASP testing methodologies and weakness taxonomies. MedTech [penetration testing](/terms/pen-test) and SAST/DAST tools are routinely benchmarked against OWASP test cases. ## What this means in practice OWASP IoT Top 10 is a useful prioritization aid for product security backlogs. The OWASP MASTG (Mobile Application Security Testing Guide) covers companion mobile apps that often ship with connected medical devices; the OWASP Application Security Verification Standard (ASVS) provides a tiered set of testable requirements. Common pitfalls - • Treating the OWASP IoT Top 10 as the entirety of the threat model rather than a baseline checklist. - • Skipping OWASP MASTG when the device ships with a companion mobile app. ## Frequently asked questions Is OWASP a standard? OWASP is an open community that produces guidance, methodologies, and tooling. ASVS and MASVS are the closest to formal verification standards; the IoT Top 10 is a prioritization list. How does OWASP IoT Top 10 differ from CWE Top 25? ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity Penetration Testing Hands-on adversarial testing in which qualified independent testers attempt to exploit a device's security controls. ](/terms/pen-test)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity)[ Cybersecurity SAST and DAST Automated security testing - SAST analyzes source code at rest, DAST exercises a running application. ](/terms/sast-dast)[ Cybersecurity Threat Modeling A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat. ](/terms/threat-modeling) ### More in Cybersecurity · Same category [ Cybersecurity AAMI SW96 AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle. ](/terms/aami-sw96)[ Cybersecurity AAMI TIR57 AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management. ](/terms/aami-tir57)[ Cybersecurity AAMI TIR97(TIR97) AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57. ](/terms/aami-tir97)[ Cybersecurity Brainjacking Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient. ](/terms/brainjacking) Cited by Where this term appears across MedTech Terms. Ecosystems (1) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 OWASP· 2 CISA· 1 1. [1 OWASP IoT Project Verified OWASP · owasp.org ](https://owasp.org/www-project-internet-of-things/) 2. [2 OWASP MASTG Verified OWASP · mas.owasp.org ](https://mas.owasp.org/MASTG/) 3. [3 CISA - Healthcare and Public Health Sector Verified CISA · cisa.gov ](https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=owasp-iot) Learn in 60 seconds Card Lesson Quiz OWASP project resources for securing IoT, embedded, and connected medical devices. - · OWASP IoT Top 10 is a useful prioritization aid for product security backlogs. - · The IoT Top 10 enumerates the most prevalent IoT security weaknesses (weak/guessable passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, etc.). Remember this Watch out: Treating the OWASP IoT Top 10 as the entirety of the threat model rather than a baseline checklist. Related terms - [Penetration Testing ](/terms/pen-test) - [SAST and DAST ](/terms/sast-dast) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) - [Threat Modeling ](/terms/threat-modeling) You may also need Auto-suggested from Cybersecurity and shared keywords. - [Patchability ](/terms/patchability) - [Secure Product Development Framework(SPDF) ](/terms/spdf) - [Code Signing ](/terms/code-signing) - [Secure Boot ](/terms/secure-boot) - [AAMI TIR57 ](/terms/aami-tir57) - [CycloneDX ](/terms/cyclonedx) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)