OWASP IoT Security Testing Guide (ISTG)
summary
OWASP ISTG presents concrete, repeatable IoT penetration steps: an eight‑interface test case catalog, clear PA1–PA4 physical access levels and unauthorized-to-manufacturing authorization levels, plus mapped outcomes and remediation guidance. Examples include a wall-mounted hotel camera (PA2, network-only tests) versus a bought smart home camera (PA4, invasive firmware extraction and internal bus analysis). Test cases state required access, exact objective, evidence to collect, and where to look for surprising, reproducible findings.
AI-written summary · about
chapters (12)
- 0:00OWASP IoT Security Testing Guide
- 1:47ISTG project origin and purpose
- 3:54IoT penetration testing challenges
- 4:35Physical access levels in testing
- 8:28Authorization access levels
- 9:52Test case catalog structure
- 13:45Repeatable testing benefits
- 14:27Demo: test case on IoT devices
- 18:19Future roadmap and expansions
- 20:26Adoption and community involvement
- 21:29Key takeaways and getting involved
- 22:10Q&A on testing methodologies
related talks
24mIoT Security Testing Guide (ISTG)
21mOWASP IoT Top 10
53mBuilding a Comprehensive IoT Security Testing Methodology- 53mBuilding a Comprehensive IoT Security Testing Methodology
36mOWASP IoTGoat Project Overview and Roadmap
47mField Guide to Building an Operational Technology Cybersecurity Capability
31mEcosystem, Interoperability and Standards: IoT Security
55mthe current problems with IoT security