Embedded Systems Security Training Course

Introduction

• Security vs embedded systems security

Characteristics of embedded application security

• Embedded network transactions
• Automotive security
• Android devices
• Next-generation software-defined radio

Critical aspects of an embedded system

• Microkernel vs monolith
• Independent security levels
• Core security requirements
• Access control
• I/O virtualization

Performing threat modeling and assessment

• Attackers and assets
• Attack surface
• Attack trees
• Establishsing a security policy

Developing secure embedded software

• Secure coding principles
• Secure program design
• Minimal Implementation
• Component architecture
• Least privilege
• Secure development process
• Independent expert validation
• Model-driven design
• Code review and static analysis
• Security testing
• Peer code reviews

Understanding and implementing cryptography

• Cryptographic modes
• Cryptographic hashes
• Cryptographic certifications
• Managing keys
• Block ciphers
• Message Authentication Codes
• Random Number Generation

Data protection

• Data-in-motion protocols
• Securing data in motion
• Data-at-rest protocols
• Securing data at rest

Mitigating attacks

• Common software attacks
• Preventing side-channel attacks

Retrofitting security in existing projects

• Securing bootloaders and firmware updates

Closing remarks