search

OWASP / owasp-istg

The IoT Security Testing Guide (ISTG) provides a comprehensive methodology for penetration tests in the IoT field, offering flexibility to adapt innovations, and developments in the IoT market while still ensuring comparability of test results.
https://owasp.org/www-project-iot-security-testing-guide/
Creative Commons Attribution Share Alike 4.0 International
83 stars 7 forks source link

Test Dependencies #11

Closed MartinNoc closed 2 months ago

MartinNoc commented 3 months ago

Test cases in Physical Interface, Wireless Interface, and User Interface are based on test cases in Firmware and Data Exchange Service. Does "based on" mean that these tests (e.g. ISTG-FW-INFO-002) have to be performed prior to performing the interface test (e.g. ISTG-PHY-INFO-001)?

If yes, this is not ideally represented in this Table. An example: Wireless Interface test can be conducted with physical access level PA-2, while the firmware might not be available with PA-2. However, Wireless Interface tests are based on Firmware tests.

Thanks for clarification! Best, Martin

MartinNoc commented 2 months ago

@scriptingxss @rockhoppersec Thanks in advance :)

rockhoppersec commented 2 months ago

Hi Martin,

Thanks for bringing this up and sorry for the late response.

In short: No, there are no dependencies between test cases for different components. So, each component can be tested individually on its own.

"This test case is based on: [...]" means that the test case (partially or completely) mirrors the contents of another test case. It basically means that a test case was not created out of thin air but copied from another component, because it can be applied to both.

For example, in case of ISTG-PHY-INFO-001, "this test case is based on: ISTG-FW-INFO-002" means that the test case was initially created for the firmware component (as ISTG-FW-INFO-002), but is "reused" by the component physical interfaces (as ISTG-PHY-INFO-001), because it applies to both and testers need to consider it when testing firmware or physical interfaces, etc.

Hope this clears things up. Feel free to let me know if not.

MartinNoc commented 2 months ago

Dear @rockhoppersec Thanks for clearing up. Perfectly explained! :) Best, Martin