Testování bezpečnosti IoT

Service delivered by umlaut:

• Review of hardware layout and schematics regarding secure design
• Verification of interface security: JTAG, SWD, USB, UART, SPI, CAN, I²C
• Flash ROM, memory analysis
• Glitching test

Device must be shipped to main security lab in Germany

Service delivered by umlaut:

• Static analysis, defense in depth
• Malware, backdoors, suspicious code, least privilege & access control
• Input validation and data sanitization
• Session and Memory management
• Compiler options and warnings
• Error handling and race conditions
• Weak cryptography

Service delivered by DEKRA:

• Covers consultancy services prior to evaluation / certification
• Includes assessment of security policies in place, gap analysis, vulnerabilities assessment, etc.
• Applicable to concept, design, manufacturing, and debugging phases

Service delivered by DEKRA:

• Assessment of SW and HW vulnerabilities
• Optional: Assessment of mobile app or website

Service delivered by DEKRA:

• Penetration testing (partial) of SW and HW
• Optional: Penetration testing of mobile app or website
• Optional: Verification of OWASP API Top 10

Service delivered by DEKRA:

• Penetration testing (full) of SW, HW, mobile app or website
• Evaluation of updating process
• Evaluation of communications protocols
• Optional: Verification of OWASP API Top 10

Service delivered by DEKRA:

• Tailor-made penetration testing based on device features, product characteristics, etc.
• Covers device (HW & FW), cloud/web services, mobile app
• Three different approaches: White Box, Grey Box, Black Box

Service delivered by umlaut:

• Web application security of local WebUI
• Man-in-the-middle, replay-based attacks
• Privacy analysis (e.g. GDPR compliance)
• Secure remote management and backend communication
• Radio / WiFi / BT encryption & hardening
• Analysis of third-party libraries and SDKs
• Firmware reverse engineering

Service delivered by umlaut:

• Strong focus on security and privacy
• Impersonation and authorization bypass
• Privilege escalation and man-in-the-middle attacks
• Authentication and backend communication
• Reverse engineering
• App storage, logging, cloning

Service delivered by umlaut:

• Mobile-to-mobile communication
• Service discovery from subscriber / SIM card perspective towards network
• Abuse of the mobile data service to bypass charging
• Verification if malicious UEs can send binary SMS towards remote subscribers

Service delivered by umlaut:

• Security scans, identification of available services
• Firewall evasion techniques, vulnerability analysis
• Intrusive exploitation and verification
• Extensive brute-force tests
• Horizontal and vertical privilege escalation
• Web application penetration testing and OWASP TOP 10

Services delivered by HARMAN:

• End-to-end testing for HIPAA, OWASP Top 10 for IoT
• Risk analysis and mitigation
• Remediation and security engineering services
• GDPR compliance

Service delivered by HARMAN:

• IoT application & network monitoring
• L1 and L2 technical support
• Asset management SaaS
• On-site service (Basic and Advanced)
• Remote operational monitoring

Service delivered by DEKRA:

• Support to perform and complete GSMA IoT Security Guidelines Assessment
• Includes preparation of Checklist (CLP.17 document) for endpoints, services, and communication networks
• Optional: Evaluation of compliance of GSMA Security Guidelines

Service delivered by DEKRA:

IoT security certification according to ETSI EN 303 645, 3 levels of evaluation:

• Constrained device
• Normal
• Full

Service delivered by DEKRA:

• IEC 62443-4-1 certification
• Applicable to Industrial Automation and Control System (IACS) device manufacturers
• Assess the secure product development life cycle

Package options:

• Maturity level 1: Statement of conformity (no DEKRA Seal)
• Maturity level 2: Certificate (DEKRA Seal)

Service delivered by DEKRA:

• IEC 62443-4-2 certification
• Applicable to Industrial Automation and Control System (IACS) devices
• Product certification
• IEC 62443-4-1 process evaluation is a pre-requisite
• Security level 1 and higher covered
• Statement of conformity

Service delivered by DEKRA:

IoT security certification according ISO 15408, 4 levels of evaluation:

• EAL1
• EAL2
• EAL3
• EAL4

Service delivered by DEKRA:

Authorized Lab certification (Black or White Box) for ioXt Alliance, with options:

• Baseline certification
• Specific profiles: Android, Mobile App, Network Lighting, Residential Camera, Speaker

Service delivered by DEKRA:

• IoT security evaluation according to NIST IR 8259 standard

Service delivered by DEKRA:

IoT security certification according to CTIA guidelines, 3 levels of evaluation:

• Level 1 (Core Security)
• Level 2 (Enhanced Security)
• Level 3 (Advanced Security)