Standard Level - 3 days- onsite team training
Essential aspects of this training course are covered in the 5 day class Comprehensive Embedded Linux Security View course info, dates and locations
Linux is being used in an increasing number of embedded devices including smart building and energy devices, set-top-boxes, automotive in-vehicle infotainment, WiFi routers and home gateways, smart meters, industrial monitoring equipment and even domestic white goods.
Increasingly these devices are being connected to networks and this can leave them vulnerable to remote attacks that can result in brand damage, financial liabilities, product returns and even safety issues.
"Hardening" Linux systems to make them more resistant to attack is possible and is something that should be performed for every connected product. Our courses cover three aspects of system hardening:
- Hardening the Linux operating system itself
- Protecting applications running under Linux (this course)
- Running applications in sandboxes - more detail on a specialised approach to protecting systems and the applications running on them
Workshops comprise approximately 50% of class time and are based around carefully designed hands-on exercises to reinforce learning. Doulos is an independent company, enabling delegates to receive the benefit of objective tuition while learning in the context of their chosen tool chain.
Who should attend?
This course is designed for engineers who need to get familiar quickly with determining the vulnerabilities in their systems and securing them. It is focused on the capabilities and features that Linux provides to protect against security attacks.
What will you learn?The course contains a mix of theory and practical sessions. Using a practical example system, it teaches each participant to increase the security step-by-step by:
- Understanding security requirements and what needs to be protected
- Analysing the system and software architecture with respect to security
- Understanding how systems are attacked
- Hardening the software environment to resist commonly used attacks
- Restricting access to and from the network
- Protecting sensitive data on the filesystem
This is a technical training course aimed at engineers, so a basic level of knowledge in the following is required:
- Linux/Unix command line
- Basic Linux system administration and configuration
Please contact Doulos direct to discuss and assess your specific experience against the pre-requisites.
Doulos training materials are renowned for being the most comprehensive and user friendly available. Their style, content and coverage is unique in the embedded systems training world, and has made them sought after resources in their own right. The materials include:
- Fully indexed class notes creating a complete reference manual
- Workbook full of practical examples and solutions to help you apply your knowledge
Structure and Content
Security fundamentalsWhat is security and why is it necessary? • Security concepts and terminology • Defense-in-depth approach • Why are devices attacked and who attacks them? •The guiding principles of securing a system
The Secure Software Development LifecycleIntroduction to the Secure Software Development Lifecycle process • Why built-in-by-design security is important • Identifying what to protect • Security design and architecture • Threat modelling and mitigation design • Security assessment • Software implementation • Security testing • Release and maintenance •Practicals: Creating a threat model, defining security requirements
Common attacks and mitigationsFundamental system software vulnerabilities • Application level attacks • Attacks against the system • Side-channel attacks • Mobile application security • Practical: Common attacks and protecting against them
Using Open Source softwareWhat is Open Source Software? • Why is Open Source Software used? • What are the disadvantages of Open Source Software? • The GNU Public Licenses • How to use OSS in commercial code • OSS security vulnerability disclosure policies
Introduction to cryptographyWhat is cryptography and cryptanalysis? • Hashes • Block and stream ciphers • Asymmetric and symmetric ciphers • Retrofitting security to an existing design • Message authentication codes • Common cryptographic software libraries
Network securityData in motion • The internet protocol suite • Link layer protection • Internet and transport layer protection • Application layer protection • Network domains, firewalls and port forwarding • Wireless security • Other digital connectivity threats • Practicals: Port scanning, implementing a firewall
Securing the software environmentDynamic loading • Limiting resources • Limiting kernel access • Practical: Dynamic linking
Developing, building and maintaining secure softwareWriting secure software • The secure software developer • Coding conventions and standards • Working with sensitive data and algorithms • Code review and test • Choice of programming language • Software maintenance
Security testing and release controlTesting and the Secure Software Development Lifecycle • Release management • Test tools • Practical: basic penetration testing
Security testing toolsSystem breaking tools • Network tools • File system tools • Vulnerability testing and exploit frameworks • Web server test tools
The course can also be tailored to suit your particular hardware and software environment. Please contact Doulos to discuss your specific requirements.
Looking for team-based training, or other locations?
Complete an on-line form and a Doulos representative will get back to you »
Price on request
Back to top