## Appendix A  
A non-exhaustive list of assets, possible threats, vulnerabilities and respective security controls for WBAN applications is presented in in Table A1. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Asset Name** & **Asset Sub-Category** & **Threat Name** & **Vulnerabilities** & **Security Controls** \\ \hline \multirow{4}{*}{Operating system} & \multirow{4}{*}{Malware} & Over-privileged users & \multirow{4}{*}{Malware protection} \\  & & Over-privileged code & & \\  & & Use of the same operating system & & \\ \cline{2-4}  & \multirow{2}{*}{Code injection} & Input validation & \multirow{2}{*}{Input validation} & \multirow{2}{*}{Output validation} \\  & & vulnerability & & \\ \hline \multirow{4}{*}{Software libraries} & \multirow{2}{*}{Third-parties failures} & Insecure ecosystem interfaces & \multirow{2}{*}{\
\begin{tabular}{} \end{tabular} } \\  & & & third-party services \\ \hline \multirow{4}{*}{Application software} & Command injection & Input validation vulnerability & Input validation \\ \cline{2-4}  & \multirow{2}{*}{Repudiation attack} & Access control vulnerability & Logging \\  & & Logging and auditing & Access control \\  & & vulnerability & Non-repudiation \\ \hline \multirow{4}{*}{Device identity including location information} & \multirow{4}{*}{Attacks on privacy} & Insecure data storage & Encryption \\  & & Insufficient privacy protection & Authorization \\ \cline{2-4}  & \multirow{2}{*}{
\begin{tabular}{} \end{tabular} } & \multirow{2}{*}{Insecure data storage} & Encryption \\  & & Information leakage & & \\ \cline{2-4}  & & & & \\ \hline \multirow{4}{*}{Sensor Device} & \multirow{4}{*}{Data collected from the sensor device} & Modification of information & Insecure communication & Encryption \\  & & information & Insecure data storage & Data integrity \\ \cline{2-4}  & \multirow{2}{*}{Replay attack} & Lack of session management & Session management \\  & & Insufficient cryptography & Encryption \\ \hline \multirow{4}{*}{Device resources} & \multirow{4}{*}{Processing} & Buffer overflow & \multirow{2}{*}{Buffer overflow} & \multirow{2}{*}{Code review} \\  & & attack & & \\ \cline{1-1} \cline{5-5}  & \multirow{2}{*}{Denial of Service resources} & \multirow{2}{*}{Input validation vulnerability} & Blocking brute force attacks \\ \cline{1-1} \cline{5-5}  & & & Access control \\ \cline{1-1} \cline{5-5}  & & & Session management \\ \cline{1-1} \cline{5-5}  & \multirow{2}{*}{Memory} & Buffer overflow & \multirow{2}{*}{Buffer overflow} & \multirow{2}{*}{Code review} \\ \cline{1-1} \cline{5-5}  & & communication & & Encryption \\ \cline{1-1} \cline{5-5}  & & protocol hijacking & Insecure communication & Authentication \\ \hline \multirow{4}{*}{-} & \multirow{4}{*}{Masquerading attack} & Lack of access control & Access control \\ \cline{1-1}  & & & Insecure authorization & Authorization \\ \cline{1-1} \cline{5-5}  & & Insufficient cryptography & Encryption \\ \cline{1-1} \cline{5-5}  & \multirow{2}{*}{Physical attacks} & Lack of physical hardening & Physical protection \\ \cline{1-1} \cline{5-5}  & & & Client platform security \\ \hline \hline \end{tabular}
\end{table} 
Table A1: List of assets, threats, vulnerability and security controls for WBAN application.