- Automobiles and other vehicles.
- Home appliances, such as clothes washers and dryers, ranges and ovens, refrigerators, thermostats, televisions, video games, video surveillance systems, and home automation systems.
- Medical care devices, such as IV infusion pumps and patient monitoring.
- Heating, ventilation, and air conditioning (HVAC) systems.
- Commercial video surveillance and key card systems.
- Automated payment kiosks, fuel pumps, and automated teller machines (ATMs).
- Network devices such as routers, switches, modems, firewalls, and so on.
Some of the design defects in this class of device include
- Lack of a security patching mechanism. Most of these devices utterly lack any means for remediating security defects that are found after manufacture.
- Lack of anti-malware mechanisms. Most of these devices have no built-in defenses at all. They’re completely defenseless against attack by an intruder.
- Lack of robust authentication. Many of these devices have simple, easily-guessed default login credentials that cannot be changed (or, at best, are rarely changed by their owners).
- Lack of monitoring capabilities. Many of these devices lack any means for sending security and event alerts.
Many manufacturers of embedded, network-enabled devices do not permit customers to alter their configuration or apply security settings. This compels organizations to place these devices on separate, guarded networks.