Embedded Systems Security Training Course

Introduction

• Comparing general security with embedded systems security

Key Features of Embedded Application Security

• Embedded network transactions
• Automotive security
• Android devices
• Next-generation software-defined radio

Essential Components of an Embedded System

• Microkernel versus monolithic architectures
• Independent security levels
• Core security requirements
• Access control mechanisms
• I/O virtualization

Conducting Threat Modeling and Assessment

• Identifying attackers and valuable assets
• Analyzing the attack surface
• Constructing attack trees
• Defining a security policy

Building Secure Embedded Software

• Foundations of secure coding
• Designing secure programs
• Implementing minimal solutions
• Component-based architecture
• Applying the principle of least privilege
• Establishing a secure development process
• Obtaining independent expert validation
• Utilizing model-driven design
• Performing code review and static analysis
• Conducting security testing
• Executing peer code reviews

Mastering Cryptography Implementation

• Cryptographic modes of operation
• Using cryptographic hashes
• Cryptographic certifications
• Key management strategies
• Understanding block ciphers
• Applying Message Authentication Codes
• Random Number Generation techniques

Protecting Data

• Protocols for data in motion
• Securing data during transmission
• Protocols for data at rest
• Securing data while stored

Defending Against Attacks

• Mitigating common software attacks
• Preventing side-channel attacks

Enhancing Security in Existing Projects

• Hardening bootloaders and firmware updates

Summary and Path Forward