Introduction to Security
Why is security necessary • What are vulnerabilities • Overview of Secure Software Development Lifecycle
Writing Secure C/C++ Code 1 - Memory Vulnerabilities and Attacks
Safe use of pointers • Memory allocation and corruption • Buffer overflow • Return Oriented Programming
Writing Secure C/C++ Code 2 - Vulnerabilities and Mitigations
String and format functions • Integer security • Concurrency • File I/O
Lab - Memory Overflow-based attacks
Secure Software Development Lifecycle
Software design goals and threats • Threat modelling
Lab - Creating a Threat Model
Cryptography
Encryption and Decryption • Hashes • Block encryption • Block Cipher Modes • AES • Streaming Ciphers • ChaCha20+Poly1305 • AEAD
Lab - Message encryption/decryption
Cryptography in Action
Key management • Signing • Certificate and Certificate Agencies • Pre-shared secrets
Lab - Installing and using certificates
Transport Layer Security
Secure communications • Random Number Generators • Authentication • IoT Protocols • MQTT • DTLS • HTTPS • TLS Implementation • Wireless LAN Security and Threats
Lab - Sending secure messages
Rules for Secure Coding
Common Criteria • CWE and CVE • The Role of Coding Standards • CERT C and MISRA-C • Dynamic and Static Analysis
Lab - Use of static analysis tools
Secure Embedded System Software Architecture
Secure software architecture goals • Traditional guiding principles • Side channel & timing attacks • Least privilege, trust and secure processes • Arm Platform Security Architecture (PSA)
Lab - Side-channel timing attack
Secure Embedded System Hardware Architecture
Security in hardware • Crypto-Accelerator Overview • Arm TrustZone • Secure boot and update • Hardware options for security
Testing for Security
Unit tests and frameworks • Tools • Penetration Testing • Protocol Fuzzing • Disassembly • Simple Power Analysis (SPA) • Differential Power Analysis (DPA)
