Penetration testing
An authorized, simulated attack on a device, application or network carried out to find exploitable weaknesses before a real attacker does.
A penetration test of an IoT product goes beyond the web application. Testers open the enclosure and look for debug ports, dump the flash memory and search it for keys, sniff and replay the radio traffic, probe the mobile app and the cloud API, and check whether an update can be forged. Findings are rated by impact and reported with reproduction steps so the vendor can fix them.
The exercise is only as good as its scope and timing. Testing the final firmware a week before launch leaves no time to fix a hardware-level finding, so mature teams test early prototypes and again before release. Standards such as IEC 62443 and schemes based on ETSI EN 303 645 specify assessment activities that overlap heavily with a good penetration test.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.