Thursday 16 August 2018

Developing & Delivering KnowHow

Home > Training > Embedded Linux Security Sandboxes

Secure EmbeddedEmbedded Linux Security Sandboxes

Standard Level - 3 days - onsite team training

Essential aspects of this training course are covered in the 5 day class Comprehensive Embedded Linux Security
View course info, dates and locations

Linux is being used in an increasing number of embedded devices including smart building and energy devices, set-top-boxes, automotive in-vehicle infotainment, WiFi routers and home gateways, smart meters, industrial monitoring equipment and even domestic white goods.

Increasingly these devices are being connected to networks and this can leave them vulnerable to remote attacks that can result in brand damage, financial liabilities, product returns and even safety issues.

"Hardening" Linux systems to make them more resistant to attack is possible and is something that should be performed for every connected product. Our courses cover three aspects of system hardening:

  • Hardening the Linux operating system itself
  • Protecting applications running under Linux
  • Running applications in sandboxes (this course) - more detail on a specialised approach to protecting systems and the applications running on them

Workshops comprise approximately 50% of class time and are based around carefully designed hands-on exercises to reinforce learning. Doulos is an independent company, enabling delegates to receive the benefit of objective tuition while learning in the context of their chosen tool chain.

Who should attend?

This course is designed for engineers who need to get familiar quickly with determining the vulnerabilities in their systems and securing them. It is focused on the capabilities and features that Linux provides to protect against security attacks.

What will you learn?

The course contains a mix of theory and practical sessions. Using a practical example system, it teaches each participant to increase the security step-by-step by:

  • Understanding security requirements and what needs to be protected
  • Analysing the system and software architecture with respect to security
  • Understanding how systems are attacked
  • Hardening the software environment to resist commonly used attacks
  • Restricting access to and from the network
  • Protecting sensitive data on the filesystem
  • Isolating and sandboxing vulnerable software components
  • Using advanced techniques such as Linux Security Modules (including SELinux) to limit the impact of a successful attack

Pre-requisites

This is a technical training course aimed at engineers, so a basic level of knowledge in the following is required:

  • Linux/Unix command line
  • Basic Linux system administration and configuration

Please contact Doulos direct to discuss and assess your specific experience against the pre-requisites.

Training materials

Doulos training materials are renowned for being the most comprehensive and user friendly available. Their style, content and coverage is unique in the embedded systems training world, and has made them sought after resources in their own right. The materials include:

  • Fully indexed class notes creating a complete reference manual
  • Workbook full of practical examples and solutions to help you apply your knowledge

Structure and Content

Security fundamentals

What is security and why is it necessary? • Security concepts and terminology • Defense-in-depth approach • Why are devices attacked and who attacks them? • The guiding principles of securing a system

Threat modelling

Introduction to the Secure Software Development Lifecycle process • Why built-in-by-design security is important • Identifying what to protect • Security design and architecture • Threat modelling and mitigation design • Practicals: Creating a threat model, defining security requirements

Application security

Access models • The Unix security model • Process privileges and capabilities • Process resources and execution limits • Sandboxes • Securing inter-process communication • Practical: Implementing an LXC sandbox

Linux Security Modules

The origin and role of LSMs • Mandatory Access Control • LSMs used in embedded systems • Performance impacts of LSMs • Practical: creating a sandbox using LSM • Practical: adding LSM hardening to an LXC sandbox

Securing the software environment

Dynamic loading • Limiting resources • Limiting kernel access • Practical: Dynamic linking

Network security

Data in motion • The internet protocol suite • Link layer protection • Internet and transport layer protection • Application layer protection • Network domains, firewalls and port forwarding • Wireless security • Other digital connectivity threats • Practicals: Port scanning, implementing a firewall

 

The course can also be tailored to suit your particular hardware and software environment. Please contact Doulos to discuss your specific requirements.


Essential aspects of this training course are covered in the 5 day class:
Embedded Linux Security View course info, dates and locations

Price on request


Back to top
Privacy Policy Site Map Contact Us