Practical IoT Hacking

3 A Security Testing Methodology

Where do you start when you want to test an IoT system for vulnerabilities? If the attack surface is small enough, as in the case of a single web portal that controls a surveillance camera, planning a security test might be simple. Even then, however, if the testing team doesn’t follow a set methodology, they might miss critical points of the application.

This chapter provides you with a rigorous list of steps to follow when penetration testing. To do so, we’ll divide the IoT attack surface into conceptual layers, as shown in Figure 3-1.

Figure 3-1: The conceptual layers to test in a security assessment ...