1.2.9 should be moved below 5.1.7 about iot-security-verification-standard-isvs HOT 2 CLOSED

Agree, we will should move 1.2.9 to the hardware section.

5.1.7 is an added layer requiring skills and tools attackers need in order to start poking around. It's not a security control per se but its raises the barrier of entry to identify vulnerabilities in hardware. If soldered headers are already on the board, it saves the attacker reverse engineering time to enumerate test points and pads.

JTAG without secure JTAG may be easy if there are openocd configs for the target board (i.e. TAP or DAP offsets, reset pin offsets, etc.)or purchasing expensive commercial JTAG debuggers that have configs preloaded. UART could be super simple if not protected but does not give full access to memory or the processor like JTAG does.

With that said, perhaps the control objective should be modified to reflect some of these considerations.?

from iot-security-verification-standard-isvs.

Updates applied
d7b1fcd
75b251d

from iot-security-verification-standard-isvs.