2.4.11 Mobile Application
This section’s intended audience is for those personnel who are responsible for the security of the IoT Product or Services’ Mobile Application. Guidance is available from the IoTSF (IOTSF.SD-BPG) regarding Application Security (part E) and Credential Management (part F).
| Req No | Requirement | Primary Keyword | Secondary Keyword | Compliance Class And Applicability |
|---|---|---|---|---|
| 2.4.11.1 | Where an application’s user interface password is used for login authentication, the initial password or factory reset password is unique to each device in the product family. | System | Software | Mandatory for all classes |
| 2.4.11.2 | Password entry follows industry standard practice. | System | Software | Mandatory for all classes |
| 2.4.11.3 | The mobile application ensures that any related databases or files are either tamper resistant or restricted in their access. Upon detection of tampering of the databases or files, they are re-initialised. | System | Software | Mandatory for Class 1 and above |
| 2.4.11.4 | Where the application communicates with a product-related remote server(s), or device, it does so over a secure connection. | System | Software | Mandatory for Class 1 and above |
| 2.4.11.5 | The product securely stores any passwords using an industry standard cryptographic algorithm. | System | Software | Mandatory for Class 1 and above |
| 2.4.11.6 | Where passwords are entered on a user interface, the actual pass phrase is obscured by default to prevent the capture of passwords. | System | Software | Mandatory for Class 1 and above |
| 2.4.11.7 | All data being transferred over interfaces should be validated where appropriate. This could include checking the data type, length, format, range, authenticity, origin and frequency. | System | Software | Mandatory for Class 1 and above |
| 2.4.11.8 | Secure Administration Interfaces; It is important that configuration management functionality is accessible only by authorised operators and administrators. Enforce Strong Authentication over administration interfaces, for example, by using certificates. | System | Software | Mandatory for Class 1 and above |
| 2.4.11.9 | All application inputs and outputs are validated using for example an allowed-list containing authorised origins of data and valid attributes of such data. | System | Software | Mandatory for Class 1 and above |
| 2.4.11.10 | Mobile Apps should be developed using best practice secure coding techniques and server frameworks. | System | Software | Mandatory for Class 1 and above |
| 2.4.11.11 | App interface should provide a simple method (one to two clicks) to initiate any security update to the end device. | System | Software | Mandatory for Class 1 and above |
| 2.4.11.12 | Access to device functionality via a network/web browser interface in the initialized state should only be permitted after successful Authentication using current best practice secure cryptographic modules. | System | Software | Mandatory for Class 1 and above |
| 2.4.11.13 | Any personal data communicated between the mobile app and the device shall be encrypted. Where the data includes sensitive personal data then the encryption must be appropriately secure. | System | Software | Mandatory for Class 1 and above |