6.3.23 When devising attack scenarios, the operational environment in which the DUT is expected to be used should be taken into consideration. For example, smart home devices are usually placed in the home and thus are not subjected to attackers with physical access to visible interfaces. Attacks are usually conducted through the network that the smart devices are connected to. The attack scenarios shall focus on the logical interfaces accessible by potential attackers. On the other hand, a smart door lock that is installed in publicly accessible locations might be subjected to simple non-destructive physical tests. 6.3.24 The testing laboratory should identify sensitive assets that must be protected and devise attack scenarios to test that the sensitive assets are indeed adequately protected (e.g. Sensitive and private user data must be encrypted, cryptographic keys, passwords etc.). Penetration Testing 6.3.25 The testing laboratory shall prioritise the test cases to ensure the intended outcome of the labelling scheme could be achieved. 6.3.26 The testing laboratory is not expected to perform advanced attacks (e.g. laser injection, hardware side channel attacks). However, should such attacks be feasible within the timeframe of the testing or be practically executed by a potential attacker in the actual deployment environment, the testing laboratory shall execute such attacks on the DUT during testing. Password Cracking 6.3.27 If the testing laboratory manages to obtain encrypted files containing sensitive credentials (user credentials, credentials to associated web services, etc.), the testing laboratory shall explore the brute-forcing of these files in an attempt to retrieve them. 6.4 PASS CRITERIA 6.4.1 The DUT is deemed pass if no critical or significant vulnerabilities are uncovered. 6.5 DELIVERABLES 6.5.1 The testing laboratory shall submit a concise test report containing the following: 1. Executive Summary 2. Verdict on the analysis of guidance document 3. Test results from tests in Minimum Test Specification. a. For test cases the DUT passes, an indicative statement by the lab would suffice. b. For test cases which the DUT failed, the lab shall record the CLS Publication #2 | Page 18 of 49