IoT Penetration Testing Cookbook

Step 6 - rating the threats

Since we have identified and documented threats for our DVR, let's rate the threats with their likelihood as well as their possible impact using the DREAD rating system. Earlier in the chapter, we introduced the DREAD rating system but, as noted, there are other rating systems available to use. The rating values for each letter in DREAD range from 3 for high, 2 for medium, and 1 for low.

For DREAD, the final risk is ranked using the following ratings:

Risk rating	Result
High	12-15
Medium	8-11
Low	5-7

 

An example of a threat rating for a threat case in our DVR system is given as follows:

Threat risk rating: Attacker could remotely view camera feeds without authorization

Item ...