OWASP IoT Top 10: the 10 risk categories, explained

The OWASP IoT Top 10 is a list of the ten highest-priority security risks to avoid when building, deploying or managing Internet of Things systems, published by the OWASP (Open Worldwide Application Security Project) Internet of Things project. The current edition, released in December 2018, replaced an earlier 2014 list and deliberately merged what had been separate risk/threat/vulnerability views into one list aimed at developers, manufacturers, enterprises and consumers at once. It is a free awareness and design-checklist resource, not a certification scheme or a legal requirement.

The 10 items in full

OWASP's 2018 list, in its published order and wording:

#	Item	What it covers
1	Weak, Guessable, or Hardcoded Passwords	"Use of easily bruteforced, publicly available, or unchangeable credentials, including backdoors in firmware or client software that grants unauthorized access to deployed systems."
2	Insecure Network Services	"Unneeded or insecure network services running on the device itself, especially those exposed to the internet, that compromise the confidentiality, integrity/authenticity, or availability of information or allow unauthorized remote control."
3	Insecure Ecosystem Interfaces	"Insecure web, backend API, cloud, or mobile interfaces in the ecosystem outside of the device that allows compromise of the device or its related components. Common issues include a lack of authentication/authorization, lacking or weak encryption, and a lack of input and output filtering."
4	Lack of Secure Update Mechanism	"Lack of ability to securely update the device. This includes lack of firmware validation on device, lack of secure delivery (un-encrypted in transit), lack of anti-rollback mechanisms, and lack of notifications of security changes due to updates."
5	Use of Insecure or Outdated Components	"Use of deprecated or insecure software components/libraries that could allow the device to be compromised. This includes insecure customization of operating system platforms, and the use of third-party software or hardware components from a compromised supply chain."
6	Insufficient Privacy Protection	"User's personal information stored on the device or in the ecosystem that is used insecurely, improperly, or without permission."
7	Insecure Data Transfer and Storage	"Lack of encryption or access control of sensitive data anywhere within the ecosystem, including at rest, in transit, or during processing."
8	Lack of Device Management	"Lack of security support on devices deployed in production, including asset management, update management, secure decommissioning, systems monitoring, and response capabilities."
9	Insecure Default Settings	"Devices or systems shipped with insecure default settings or lack the ability to make the system more secure by restricting operators from modifying configurations."
10	Lack of Physical Hardening	"Lack of physical hardening measures, allowing potential attackers to gain sensitive information that can help in a future remote attack or take local control of the device."

Quoted text is reproduced from the OWASP IoT Top 10 2018 document; the project page for the current Internet of Things project lists and links to it.

Why one list instead of several

OWASP's own introduction to the 2018 release explains the project team's reasoning: rather than maintain separate lists for risks versus threats versus vulnerabilities, or separate lists for developers versus enterprises versus consumers, the team "elected to have a single, unified list that captures the top things to avoid when dealing with IoT Security," because "there are now dozens of organizations releasing elaborate guidance on IoT Security" aimed at different audiences. The stated theme of the 2018 edition is simplicity.

How the list was built

The project documents a six-phase methodology:

1. Team formation — recruiting volunteer subject-matter experts and project leaders from manufacturers, consultancies, security testing and development backgrounds.
2. Project review — assessing what had changed in the industry since the 2014 list.
3. Data collection — reviewing public and private vulnerability sources, weighted toward issues that caused the most real-world impact.
4. Sister-project review — cross-checking the draft against other IoT security guidance, naming as examples the CSA IoT Controls Matrix, CTIA, Stanford's Secure Internet of Things Project, NISTIR 8200, ENISA's IoT Baseline Report, and the UK's Code of Practice for Consumer IoT Security.
5. Community draft feedback — a public comment period including social-media calls for feedback and talks.
6. Release — publication in December 2018.

Has it been updated since?

The 2018 document states the team's intent "to continuing [sic] to improve the list on a two-year cadence." This guide could not confirm a later numbered IoT-specific Top 10 release on OWASP's project page; the project's current Internet of Things page still lists the 2018 edition as the Top 10 resource, alongside newer companion projects such as the IoT Security Testing Guide (ISTG) and the IoT Security Verification Standard (ISVS), an incubator-stage project OWASP describes as establishing "a framework of security requirements for Internet of Things (IoT) applications." Treat any claim of a newer official OWASP IoT Top 10 version as to be confirmed against OWASP's own project page before relying on it.

Where it fits next to regulation and standards

The OWASP IoT Top 10 is an awareness and design-checklist resource built by volunteers; it carries no certification scheme and no legal weight on its own. Device makers selling into regulated markets still need the actual standards and legal texts:

• ETSI EN 303 645 sets a formal, versioned baseline of consumer IoT security provisions (see our ETSI EN 303 645 guide) — its first three provisions (unique passwords, a vulnerability-reporting contact, and disclosed security-update periods) map closely onto OWASP items 1, 4 and 8.
• The EU Cyber Resilience Act's Annex I essential requirements (see our CRA guide) cover update mechanisms, default configuration and vulnerability handling — overlapping with OWASP items 1, 4, 5, 8 and 9 — but the CRA text does not reference OWASP's list by name.
• IEC 62443-4-2 sets technical requirements for industrial components (see our IEC 62443-4-2 vs CRA guide), a different target audience than OWASP's consumer- and enterprise-IoT framing.

A device maker can use the OWASP IoT Top 10 as an early design and review checklist, then confirm the specific clauses a target market actually requires from the relevant formal standard or regulation — OWASP's list does not replace that step.

SoftWSP's firmware and device security reviews check products against OWASP IoT Top 10-style risk categories alongside the formal standards a target market requires: see device firmware security.

This guide summarises a public OWASP community project; it does not constitute legal or compliance advice.