Embedded Systems Security Training Course

Introduction

• Security fundamentals vs. embedded systems security

Characteristics of Embedded Application Security

• Embedded network transactions
• Automotive security protocols
• Android device security
• Next-generation software-defined radio

Critical Aspects of an Embedded System

• Microkernel vs. monolithic architectures
• Independent security levels
• Core security requirements
• Access control mechanisms
• I/O virtualization

Performing Threat Modeling and Assessment

• Identifying attackers and assets
• Analyzing the attack surface
• Constructing attack trees
• Establishing a robust security policy

Developing Secure Embedded Software

• Secure coding principles
• Secure program design strategies
• Minimal implementation techniques
• Component-based architecture
• Principle of least privilege
• Secure development lifecycle
• Independent expert validation
• Model-driven design
• Code review and static analysis
• Security testing methodologies
• Peer code review processes

Understanding and Implementing Cryptography

• Cryptographic modes of operation
• Cryptographic hashing algorithms
• Cryptographic certifications
• Key management practices
• Block cipher implementations
• Message Authentication Codes (MACs)
• Random Number Generation

Data Protection

• Data-in-motion protocols
• Securing data during transit
• Data-at-rest protocols
• Securing stored data

Mitigating Attacks

• Common software vulnerabilities and attacks
• Preventing side-channel attacks

Retrofitting Security in Existing Projects

• Securing bootloaders and firmware updates

Summary and Next Steps