IoT, Embedded and Hardware Security
IoT Product Security Assessment
We assess your connected product as a whole: device, mobile app and cloud service together. We show how a weakness in one component can affect the others.
What it is
The assessment considers the product as an ecosystem, not a single device. The device, its mobile app and the cloud service are examined together. The aim is to determine whether a key or flaw from one device can affect all devices of that model and the cloud service. The review is performed on the product as sold.
Scope
- Assessment of the device, mobile app and cloud service together
- Tracing authentication and authorization flow between components
- Testing whether information from one device is valid on other devices
- Testing user and device separation in the cloud
- Determining whether a finding affects one device or the whole product family
The need
When organizations need it
- When you need to test a new connected product as a whole before deployment.
- Before connecting a device purchased in large quantities to your corporate network.
- When your product will enter the EU market and you need to demonstrate its security posture.
Method
How we work
-
Discovery
We approach the device, app and cloud service without documentation, as an attacker would.
-
Chaining
We demonstrate step by step how a weakness in one component can affect another.
-
Spread
We determine whether each finding affects only one device or the entire product family.
Outcome
What you have at the end
You see the weaknesses in the device, app and cloud components, how they are connected, and the spread of each finding.
Frequently asked questions
How many devices do you need?
Usually at least two devices are needed. Two devices allow us to check if a key from one is valid on the other.
Do you also examine the cloud side?
Yes. The device is often not the weakest link. Authorization flaws in the cloud service can allow access to the entire fleet from one device.
IoT, Embedded and Hardware Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting