Embedded Systems Security Training Course

Introduction

• General security versus embedded systems security

Characteristics of Embedded Application Security

• Embedded network transactions
• Automotive security
• Android devices
• Next-generation software-defined radio

Critical Aspects of an Embedded System

• Microkernel vs. monolithic architecture
• Independent security levels
• Core security requirements
• Access control
• I/O virtualization

Threat Modeling and Assessment

• Attackers and assets
• Attack surface
• Attack trees
• Establishing a security policy

Developing Secure Embedded Software

• Secure coding principles
• Secure program design
• Minimal implementation
• Component architecture
• Least privilege
• Secure development process
• Independent expert validation
• Model-driven design
• Code review and static analysis
• Security testing
• Peer code reviews

Understanding and Implementing Cryptography

• Cryptographic modes
• Cryptographic hashes
• Cryptographic certifications
• Key management
• Block ciphers
• Message Authentication Codes
• Random Number Generation

Data Protection

• Protocols for data-in-motion
• Securing data in motion
• Protocols for data-at-rest
• Securing data at rest

Mitigating Attacks

• Common software attacks
• Preventing side-channel attacks

Integrating Security into Existing Projects

• Securing bootloaders and firmware updates

Summary and Next Steps