I’m currently performing a structured security/compliance assessment on an IoT device and I need clarity on how to properly perform asset discovery and interface mapping.

I want to ensure I correctly classify everything before deciding what to test.

🔹 1. How do you determine all the assets in the device?

Examples I want to identify correctly:

• Network assets → ports, services, protocols, radios, endpoints
• Security assets → authentication mechanisms, credentials, keys, admin interfaces, protected functions
• Privacy assets → personal data, identifiers, telemetry, configuration data

What’s the recommended way to enumerate all of these?

🔹 2. How do you map assets to interfaces?

For a device with multiple interfaces (e.g., LAN ports, Wi-Fi SSIDs, Web UI, mobile app API, cloud server), how do you build a structured mapping like:

| Interface | Asset | Access Method | Purpose | Public? | Restrictions |

Is there a standard approach or format?

🔹 3. How do you determine which assets should be tested?

I’m looking for guidance on:

• How to decide if an asset is security-related, network-exposed, or privacy-relevant
• How to determine if an asset is in scope or out of scope
• How to link asset classification to the type of tests required

🔹 4. What methodology do people follow?

Do you rely on:

• Interface enumeration
• Service discovery
• Documentation review
• Threat modeling
• Static analysis
• System behavior observation

I’m trying to build a repeatable process for asset discovery and classification across different devices.

Any examples, workflows, diagrams, or explanations would really help.
Thanks!