OWASP IoT Security Testing Guide
Test structure across device, firmware, communications, interfaces, and ecosystem components.
Penetration testing
IoT and Connected Systems Penetration Testing
A tailored assessment of the authorized device ecosystem, covering the product, local interfaces, communications, and supporting cloud or mobile components in scope.
Assessment scope
What is tested
The final test coverage is agreed during scoping and limited to systems for which written authorization has been provided.
Device interfaces and exposed services
Firmware handling and embedded secrets
Authentication and authorization
Update and recovery mechanisms
Radio, network, and application protocols
Associated mobile, web, and cloud services
Engagement flow
Controlled from authorization to retest.
01
Scope & authorization
Define objectives, approved systems, constraints, test windows, contacts, and rules of engagement.
02
Discovery
Establish the authorized attack surface, architecture, user roles, assets, and applicable assessment criteria.
03
Controlled testing
Assess the approved scope using manual and technical methods appropriate to the environment.
04
Validation
Confirm findings safely, remove false positives, and establish practical technical and business impact.
05
Reporting
Receive findings supported by evidence, risk ratings, an executive summary, and remediation priorities.
06
Remediation review
Review proposed corrective actions and clarify implementation priorities with the assessment team.
07
Retest
Verify agreed fixes and record whether each tested finding has been resolved, reduced, or remains open.
Assessment references
Industry standards and guidance
ETSI EN 303 645
Baseline security provisions for consumer IoT used as audit context when applicable.
NISTIR 8259 series
Device cybersecurity capability and manufacturer activity guidance.
Standards guide scope and test coverage. An assessment does not itself constitute certification or guarantee compliance.
Reporting
What you receive
Coverage of components and trust boundaries
Validated device and ecosystem findings
Evidence and practical impact
Engineering remediation guidance
Retest plan
Define an appropriate test scope.
Discuss the systems, objectives, access level, and required evidence with DIGITPOL.