Global training solutions for engineers creating the world's electronics
Menu
Embedded System Security for C/C++ Developers Online
This is a LIVE INSTRUCTOR-LED training event delivered ONLINE.
It covers the same scope and content as a scheduled in-person class and delivers comparable learning outcomes.
Embedded microcontrollers have been used for many years within electronic systems, across a huge range of applications from simple environmental monitors through to automotive components and complex consumer appliances. Security issues affecting networked computers running operating systems such as Windows and Linux (including “Embedded Linux”) are well-documented but traditionally, security was not a major concern for many small, microcontroller-based systems. However, the increasing trend to connect devices to a network, both locally and across a wide area (such as the Internet) has sometimes led to security vulnerabilities that were not anticipated by the system designers. Recent developments such as the IoT Security Foundation's Security Assurance Framework and Arm's Platform Security Architecture (PSA) provide guidance to create secure applications for developers with sufficient security proficiency to understand and apply their recommendations.
This course provides an awareness of the security issues affecting microcontroller-based embedded systems and teaches approaches to identify and protect against them. Since many of these systems are developed using the C or C++ programming languages, it looks at how C/C++ should be written to avoid security vulnerabilities. It also considers alternative software and hardware based solutions to ensure that every aspect of the embedded software application from booting, functional operation, data communication and updates is secure. The relevant sections of the Arm PSA and IoTSF Security Assurance Framework are referenced throughout the course and explored in greater detail where appropriate. The course also provides an overview of emerging industry, national and international security standards and introduces techniques for testing security which will be required for certification.
The practical side of the training is based around carefully designed exercises, investigating security features and issues for a real embedded system, to reinforce and challenge the extent of learning and comprise approximately 50% of class time.
If you have specific security application requirements, please contact the Doulos team to discuss your options.
"Embedded System Security for C/C++ Developers" is aimed at electronic hardware, software and system-on-chip engineers who need to gain a working knowledge of the software and hardware security issues affecting a microcontroller-based embedded system.
Note that this is not a course on the security issues affecting embedded Linux applications - delegates wishing to learn more about that topic are recommended to take the Doulos Practical Embedded Linux Security Online course.
Attendees should have:
Please contact Doulos directly to discuss and assess your specific experience against the pre-requisites.
Doulos training materials are renowned for being the most comprehensive and user-friendly available. Their style, content and coverage are unique in the Embedded Systems training world, and have made them sought after resources in their own right. The materials include:
Introduction to Security
Why is security necessary • Vulnerabilities, Threats and Attacks • CVE and CWE • Embedded System Security • Embedded Security Frameworks • Arm PSA • PSA Security Model Goals • Overview of Secure Software Development Lifecycle
Writing Secure C/C++ Code 1 – Memory Vulnerabilities and Attacks
Safe use of pointers • Memory allocation and corruption • Buffer overflow • Return Oriented Programming
Writing Secure C/C++ Code 2 – Vulnerabilities and Mitigations
String and format functions • Side Channel Timing Vulnerability • Integer security • Concurrency • TOCTOU • File I/O • Error Handling • Lab - Memory Overflow-based attacks
Secure Software Development Lifecycle
Secure Software Development Lifecycle and Processes • Business Requirements • Maturity Models • Threat modelling • Risk Analysis • CVSS • Attack Trees • Arm PSA • Common Criteria • PSA Analysis Phase • Target of Evaluation • PSA Protection Profile • Security Functional Requirements • Lab – Creating a Threat Model
Cryptography
Encryption and Decryption • Random Number Generators • Block encryption • Block Cipher Modes • AES • Streaming Ciphers • ChaCha20 • Hashes • AEAD
Lab - Message encryption/decryption
Cryptography in Action
Key management • Diffie Hellman, ECDH and RSA Key Exchange • Signing • HMAC • PKCS#1 • Certificate and Certificate Agencies • Pre-shared secrets • Software Provisioning
Lab - Installing and using certificates
Transport Layer Security
Secure communications • IoT Protocols • MQTT • HTTPS • TLS Cipher Suites • TLS Handshake and Record Phases • DTLS • Wireless LAN Security and Threats • Wi-Fi Protocols • Lab – Configuring TLS sockets for secure communications
Rules for Secure Coding
CWE, CVE and NVD • The Role of Coding Standards • CERT C and MISRA-C • Other Coding Standards • Static Analysis • Lab – Detecting security vulnerabilities with static analysis tools
Secure Embedded System Software Architecture
Secure software architecture goals • Traditional guiding principles • Least privilege, trust and secure processes • Side channel & timing attacks • Double HMAC • Security though Isolation • Cortex-M Modes and Privilege • Run-Time Isolation with MPU • Microcontainer Isolation • TrustZone-M • Arm Platform Security Architecture (PSA) • Trusted Boot and Firmware Update • PSA Firmware Framework • PSA APIs • Trusted Firmware-M
Lab – Performing a side-channel timing attack
Secure Embedded System Hardware Architecture
Security Requirements • Unique ID • Secure Storage • Secure Storage Lifetime • Random Number Generators • Hardware Crypto Engine • Hardware Root-of-Trust • Attestation • Secure boot and update • Memory Isolation and Protection • TrustZone SAU and IDAU • Other HW Recommendations • Secure Elements • TPM • HSM • PUF • Secure MCU Architecture
Security Testing and Provisioning
Standards and Regulations • SESIP • PSA Certified • Security Testing Approaches • Unit Tests • Testing Tools • Penetration Testing • Disassembly • Protocol Fuzzing • Side Channel Power Analysis • Secure Provisioning Process
For on-site, team-based training, please contact Doulos about tailoring this course to suit your hardware and software environment.
This course utilises the Doulos Board Farm for you to practically apply what you learn. Find out more in this video.
| 28 Jan 2025 | ONLINE Americas | Enquire |
| 03 Mar 2025 | ONLINE EurAsia | Enquire |
| 14 Apr 2025 | ONLINE Americas | Enquire |
| 22 Apr 2025 | ONLINE EurAsia | Enquire |
Complete an enquiry form and a Doulos representative will get back to you.
Enquiry FormPrice on request
