2.4.10 Web User Interface

Go to Detailed Requirements

This section’s intended audience is for those personnel who are responsible for the security of the IoT Product or Services’ Web Systems. Guidance is available from the IoTSF (IOTSF.SD-BPG) regarding Application Security (part E), and Credential Management (part F).

Req No	Requirement	Primary Keyword	Compliance Class And Applicability
2.4.10.1	Where the product or service provides a web based user interface, Authentication is secured using current best practice cryptography.	System	Mandatory for Class 1 and above
2.4.10.2	Where the product or service provides a web browser based interface, access to any restricted/administrator area or functionality shall require authentication.	System	Mandatory for Class 1 and above
2.4.10.3	Where the product or service provides a web based management interface, Authentication is secured using current best practice cryptography.	System	Mandatory for Class 1 and above
2.4.10.4	Where a web user interface password is used for login authentication, the initial password or factory reset password is unique for every device in the product family.	System	Mandatory for all classes
2.4.10.5	The web user interface is protected by an automatic session idle logout timeout function.	System	Mandatory for Class 1 and above
2.4.10.6	User passwords are not stored in plain text.	System	Mandatory for all classes
2.4.10.6.1	Strong passwords are required, and a random salt value is incorporated with the password.	System	Mandatory for Class 1 and above
2.4.10.7	Where passwords are entered on a user interface, the actual pass phrase is obscured by default to prevent the capture of passwords.	System	Mandatory for Class 1 and above
2.4.10.8	The web user interface shall follow good practice guidelines.	Business	Mandatory for Class 1 and above
2.4.10.9	A vulnerability assessment has been performed before deployment, and is repeated periodically throughout the lifecycle of the service or product.	Business	Mandatory for Class 1 and above
2.4.10.10	All data being transferred over interfaces should be validated where appropriate. This could include checking the data type, length, format, range, authenticity, origin and frequency.	System	Mandatory for Class 1 and above
2.4.10.11	Sanitise input in Web applications by using URL encoding or HTML encoding to wrap data and treat it as literal text rather than executable script.	System	Mandatory for Class 1 and above
2.4.10.12	All inputs and outputs are validated using for example an allow list (formerly 'whitelist') containing authorised origins of data and valid attributes of such data.	System	Mandatory for Class 1 and above
2.4.10.13	Administration Interfaces are accessible only by authorised operators. Mutual Authentication is used over administration interfaces, for example, by using certificates.	System	Mandatory for Class 1 and above
2.4.10.14	Reduce the lifetime of sessions to mitigate the risk of session hijacking and replay attacks. (For example to reduce the time an attacker has to capture a session cookie and use it to access an application).	System	Mandatory for Class 1 and above
2.4.10.15	All inputs and outputs are checked for validity. Tests to include both expected (valid) and unexpected (invalid) input stimuli.	Business	Mandatory for Class 1 and above
2.4.10.16	Web Interfaces should be developed using best practice secure coding techniques and server frameworks.	Business	Mandatory for Class 1 and above
2.4.10.17	Password entry follows industry standard practice.	Business	Mandatory for all classes
2.4.10.18	Web interface should provide a simple method (one to two clicks) to initiate any security update to the end device.	Business	Mandatory for all classes
2.4.10.19	Any personal data communicated between the web interface and the device shall be encrypted. Where the data includes sensitive personal data then the encryption must be appropriately secure.	Business	Mandatory for all classes