244 results
GSMA IoT Security Guidelines (CLP.11/FS.60), explained
GSMA's IoT Security Guidelines document set — the CLP.11 overview (now reissued as FS.60), its Service/Endpoint Ecosystem split, risk-assessment approach, and CLP.12's tiered (Critical/High/Medium/Low) recommendation structure — read directly from the 2017 v2.0 PDFs.
5 min read Updated
GSMA NESAS and 3GPP SCAS, explained
How GSMA's Network Equipment Security Assurance Scheme (NESAS) and 3GPP's SCAS/SECAM specifications actually work: the two-part vendor-audit-plus-product-evaluation model, the TS 33.117 generic security requirements catalogue, and how NESAS feeds EU and national certification schemes.
8 min read Updated
HART and WirelessHART protocol security: what's protected, and what still isn't
HART runs over a 4-20mA loop with no authentication at all; WirelessHART (IEC 62591) added mandatory AES-128 encryption and key management. What CISA advisories on HART DTMs and WirelessHART gateways show about where the real risk sits.
6 min read Updated
HBOM (Hardware Bill of Materials): CISA's framework explained
A software SBOM says nothing about the chips, boards and modules a device is actually built from. What CISA's September 2023 Hardware Bill of Materials Framework defines, how CycloneDX's device and firmware component types map to it, and what a device maker should start recording.
5 min read Updated
HHS 405(d) HICP (Health Industry Cybersecurity Practices), explained
HHS's 405(d) Program and its Health Industry Cybersecurity Practices (HICP): the Cybersecurity Act of 2015 mandate, the 2023 edition's 10 practices including network-connected medical device security, and the 2024 HPH Cybersecurity Performance Goals built on top of it.
5 min read Updated
HL7 FHIR API security: what the standard protects, and what CMS now requires
HL7's own FHIR specification says plainly that FHIR is not a security protocol — authentication, authorization and per-record access control are left to implementers. A 2021 test of production FHIR APIs found broken object-level authorization in every one tested, and CMS's 2024 interoperability rule now makes OAuth 2.0 and SMART App Launch mandatory by 1 January 2027.
6 min read Updated
How to fix authentication bypass in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose authentication bypass and missing authentication (CWE-287/CWE-306 and related CWEs) in embedded products, sourced to MITRE CWE.
3 min read Updated
How to fix command injection in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose OS command injection (CWE-77/CWE-78) in embedded products, sourced to MITRE CWE and OWASP.
4 min read Updated
How to fix hard-coded credentials in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose hard-coded passwords and keys (CWE-798/CWE-259) in embedded products, sourced to MITRE CWE and CISA.
3 min read Updated
How to fix SQL injection, XSS, resource exhaustion and deserialization flaws in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose SQL injection (CWE-89), cross-site scripting (CWE-79), resource exhaustion (CWE-400) and insecure deserialization (CWE-502) in embedded web UIs and management APIs, sourced to MITRE CWE and OWASP.
4 min read Updated
How to fix memory corruption in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose memory-corruption bugs (CWE-787/CWE-120 and related out-of-bounds, overflow and use-after-free CWEs) in embedded products, sourced to MITRE CWE and CISA.
3 min read Updated
How to fix path traversal in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose path traversal (CWE-22 and related CWEs) in embedded web UIs and file-handling code, sourced to MITRE CWE.
3 min read Updated
How to fix weak cryptography in embedded firmware
Practical steps for device and firmware teams to detect, fix and verify broken ciphers, inadequate key strength, hard-coded keys and weak random number generation (CWE-327/326/321/330) in embedded products, sourced to MITRE CWE and CISA.
4 min read Updated
The HSCC Joint Security Plan (JSP2): a total-product-lifecycle guide for medical device makers
What the Health Sector Coordinating Council's Medical Device and Health IT Joint Security Plan v2.0 (March 2024) covers, what changed from the 2019 original, and how it relates to FDA and AAMI SW96 guidance.
3 min read Updated
ICCP/TASE.2 protocol security, explained
How the Inter-Control Center Communications Protocol (ICCP, IEC 60870-6/TASE.2) moves real-time data between power-grid control centers, why the base protocol has no built-in authentication or encryption, and where NERC CIP and IEC 62351-4 fit.
4 min read Updated
IEC TR 60601-4-5: security capabilities for medical devices, explained
IEC TR 60601-4-5:2021 explained: how it adapts IEC 62443-4-2's industrial security requirements into capability security levels (SL-C) for medical electrical equipment, the seven foundational requirements, and what's openly available versus paywalled.
5 min read Updated
IEC 60870-5-104 security: the protocol Industroyer2 used to attack a power grid
IEC 60870-5-104 carries telecontrol traffic for power grids and water utilities in cleartext with no built-in authentication. Industroyer2's own code confirms it spoke nothing but IEC-104 to attack Ukraine's grid in 2022, and Hitachi Energy RTU500 advisories show the gap is still being found in 2026.
7 min read Updated
IEC 61850 security: what GOOSE, Sampled Values and MMS do and don't protect
IEC 61850 standardizes substation automation communication — GOOSE, Sampled Values and MMS — but the base protocol was not designed with cryptographic security in mind. What IEC 62351-6 adds, and what two 2026 CISA ICS advisories against real IEC 61850 implementations actually found.
6 min read Updated
IEC 62304: medical device software life cycle processes, explained
What IEC 62304:2006+AMD1:2015 actually requires: its nine clauses, the three software safety classes, how Class A differs from B/C evidence, FDA recognition, and the Edition 2 revision in progress.
6 min read Updated
IEC 62351: data and communications security for power system protocols, explained
What the IEC 62351 series actually covers: the 20 published parts, what each one secures (TLS profiles, GOOSE/SMV signing, RBAC, key management), and how it differs from NERC CIP-013 and IEC 62443.
6 min read Updated
IEC 62443-1-1 (Terminology, concepts and models), explained
What IEC TS 62443-1-1:2009 actually defines: the IACS reference model, zones/conduits vocabulary, Security Level concept, seven foundational requirements, and why it's still a Technical Specification 16+ years on.
6 min read Updated
IEC 62443-2-1: security program requirements for IACS asset owners, explained
What IEC 62443-2-1's 2024 edition requires of IACS asset owners: the eight Security Program Elements, the shift to a maturity model, and how it fits the wider 62443 series.
5 min read Updated
IEC 62443-2-2 (IACS security protection scheme), explained
What IEC PAS 62443-2-2:2025 actually covers: the Security Protection Scheme (SPS), the target/implemented/operated Security Protection Rating (SPR) model, the five principal roles, and how it links 62443-2-1's maturity model to 62443-3-3's security levels.
7 min read Updated
IEC 62443-2-3 (Patch management in the IACS environment), explained
What IEC TR 62443-2-3:2015 actually covers: the patch lifecycle model, recommended requirements for asset owners and IACS product suppliers, and the VPC exchange format for vendor patch compatibility data.
7 min read Updated
Questions about this page?