System Assurance with the IoT Security Testing Guide

The talk introduces the OWASP IoT Security Testing Guide, a methodology meant to make penetration tests of connected devices repeatable and comparable. The speaker notes that many device assessments arrive as static PDF reports that cannot be rerun, and that existing guides leave physical and authorization context underspecified.

The core of the talk is the guide's structure. A device model splits the target into components, from processing units and memory through firmware, interfaces and wireless links up to user interfaces. Two scoping axes then frame each engagement: physical access, ranging from remote through local and non-invasive to invasive lab work, and logical access, from unauthorized and low-privilege accounts up to high-privilege and manufacturer-level access. Test cases are listed per component with their required access levels, objectives, remediation notes and references, and are offered in checklist, markdown, spreadsheet and machine-readable formats. A worked example contrasts a wall-mounted commercial camera, where hardware-level cases drop out, with a consumer camera held in hand. Tooling ranges from firmware analysis toolkits to hardware debug interfaces such as JTAG and UART.

For practitioners, the takeaway is to define scope using both access axes so results can be repeated and compared over time. The project was in peer review and still in incubator stage, and the speaker invited contributions, especially for Bluetooth, Wi-Fi and other wireless modules and for lower-level boot and root-of-trust work.