Security Test Plan

Status: DRAFT

Network

• list listening ports
• verify firewall policy
• verify no unexpected inbound access
• verify VPN route restrictions

Authentication

• invalid NATS credential rejected
• revoked NATS credential rejected
• invalid VPN credential rejected
• cloned/duplicate identity behavior tested

Authorization

• device A cannot read/write device B subjects
• gateway cannot access privileged backend subjects

Command validation

• unsupported command rejected
• unsupported inverter rejected
• out-of-range values rejected
• raw Modbus write not exposed through remote API
• duplicate/replayed command behavior tested

Updates

• signature validation
• corrupted package rejection
• rollback
• power interruption recovery

Offline behavior

• VPN outage
• NATS outage
• backend outage
• NTP/time loss

Physical/storage

• inspect credential file permissions
• verify no secrets in logs
• test microSD cloning threat assumptions