Quick answer: IoT and OT penetration testing is a service that uncovers the security flaws of internet of things devices and industrial control systems (ICS, SCADA, PLC) in a controlled way and without stopping production. The critical difference of these systems is that the priority is not confidentiality but continuity and safe operation; in a factory a wrong test can lead to a physical consequence. The most common flaws are default passwords, unencrypted industrial protocols and the lack of network segmentation. DSET runs this test with its local AI engine KAOS, with a least impact principle.

In an office network a system crashing is a disruption; on a production line or in an energy system the same thing can produce a physical consequence. For this reason the security testing of industrial systems requires a discipline different from information networks. IoT and OT penetration testing is a service that examines these systems without putting production at risk. This article explains what IoT and OT testing is, its difference from IT testing and the DSET and KAOS approach.

What is IoT and OT penetration testing

IoT covers internet connected devices; OT covers operational technology that manages a physical process, that is industrial control systems. The goal of this test is to prove whether an attacker can reach these devices and control systems and whether they can affect the physical process. Its biggest difference from IT testing is that the priorities are in reverse order: in IT confidentiality comes first, in industry the uninterrupted and safe operation of the system comes first.

Dimension Information (IT) test Industrial (OT) test
Primary priority Confidentiality and data Continuity and safe operation
Test aggressiveness Can be high Low, does not stop production
Typical protocol HTTP, TCP, TLS Modbus, DNP3, OPC UA
Most common flaw Software and configuration Default password, lack of segmentation
Consequence of a wrong test Service outage Physical and safety consequence

The essence of the table is: industrial testing carries the same goal as IT testing but is run with the opposite caution. For which standard frame this test is done within, the penetration testing standards PTES, OWASP, OSSTMM and NIST comparison is the reference point.

The most common flaws

In industrial systems most flaws stem not from a software bug but from a design assumption unchanged for years: the assumption that the network is isolated. When this assumption breaks, default passwords, industrial protocols without authentication and the mixing of the information network with the industrial network open a wide area to an attacker. Wireless access points are also a frequently forgotten part of this surface; the deep examination of the wireless side falls within the scope of wireless network WiFi penetration testing. An attacker's passage from one system to another is evaluated together with Active Directory and internal network penetration testing.

How this test is run safely

An industrial test is measured not by its aggressiveness but by its caution. The right approach is, when possible, to run the test on a laboratory copy or in a maintenance window, and on a live system to work only with passive and low impact methods. Authorization boundaries and which operations can be done on a live system are set in writing before the test within the frame of contract and legal authorization. The discovery of access points that open to these systems from the external surface combines with our external attack surface management service.

The KAOS and DSET approach

DSET runs IoT and OT penetration testing with its local AI engine KAOS, with a least impact principle. KAOS maps industrial protocols and devices, detects points left open with no authentication and default configuration and proves a finding only with a separate and explicit approval, in a controlled way. The difference is this: no operation that could affect live production is run without prior written approval; the default behavior is passive and at the read level. Every finding is reported with the principle of proof based verification. The DSET team runs a dedicated laboratory effort on energy and industrial control systems.

Frequently asked questions

Does penetration testing an OT system stop production? In a well planned test no. The most important rule of industrial testing is not to put production at risk. For this reason high impact attempts are done, when possible, on a laboratory copy or in a maintenance window; on a live system passive and low impact methods are used. Which operation can be done live is decided in writing in advance.

Is a separate test needed for IoT devices? IoT devices carry a network asset, an application and often a cloud interface all at once. For this reason their test is not one dimensional: the device itself, the network protocol it speaks and the cloud service it connects to are examined together. The real flaw of a smart device is often found not in the device but in the backend service that manages it.

Which sectors should have this test? Every sector that manages a physical process with a control system: energy and electricity, water and infrastructure, manufacturing and factory, logistics and building automation. In these sectors a cyber incident can produce not only data loss but a physical and safety consequence; for this reason industrial testing requires higher caution than IT testing.

Sources

To examine your industrial control systems and IoT devices with a proof based test and without putting production at risk, contact DSET. We provide IoT and OT penetration testing and consulting from our Ankara Hacettepe Teknokent laboratory.