iSAQB CPSA-A EMBEDDEDSEC

Description

Attending the iSAQB® CPSA-A Embedded Security for Architects (EMBEDDEDSEC) course gives participants 10 Technical Competence (TC) points and 20 Methodological Competence (MC) towards the 70 points required for eligibility to take the iSAQB CPSA-A exam with Brightest. It is important to remember that as part of the 70 points required to take the iSAQB CPSA-A exam with Brightest, you will need at least ten competence points in each of the following areas: 

• Technical Competence (TC)
• Methodological Competence (MC)
• Communicative Competence (CC)

Accredited iSAQB® EMBEDDEDSEC - Embedded Security for Architects (CPSA-A) training is based on the current iSAQB® curriculum:

Part 1 - Introduction

• Security as a quality attribute of an architecture
• The security triad: confidentiality, integrity, and availability
• Additional security properties, including authentication, authorization, and non-repudiation
• Security throughout the complete product lifecycle
• Relevant security regulations, standards, and guidelines

Part 2 - Security Analysis

• Creating a system definition and system context
• Identifying assets and potential damage scenarios
• Applying attacker-, asset-, and system-centric threat-modeling approaches
• Identifying and analyzing threats and attack paths
• Using architectural views for threat modeling
• Assessing and rating security risks

Part 3 - Verification

• Goals and classifications of security verification methods
• Static, dynamic, and interactive application security testing
• Static analysis techniques, including software composition, semantic code, vulnerability, and taint analysis
• Dynamic testing techniques, including fuzz testing, vulnerability scanning, and robustness testing
• Goals, stages, and role of penetration testing

Part 4 - Cryptography

• Goals and basic functions of cryptography
• Symmetric cryptography and its use cases
• Asymmetric cryptography and preparation for post-quantum attacks
• Secure hashing and recommended use cases
• Key derivation functions
• Randomness, entropy, and secure random-number generation

Part 5 - Embedded Security Threats

• Attacker capabilities, knowledge, and motivations
• Weaknesses, vulnerabilities, attacks, and attack surfaces
• Sources of information about security threats and vulnerabilities
• Common attack patterns, including injection, privilege escalation, denial of service, and reverse engineering
• Hardware attack surfaces and invasive and non-invasive attacks

Part 6 - Embedded Security Design Considerations

• Security as a cross-cutting quality of embedded systems
• The relationship between safety and security
• Security-by-design principles, including defense in depth, least privilege, and data minimization
• The effect of resource restrictions on security solutions
• The role and secure deployment of software updates
• Secure implementation techniques, standards, and guidelines

Part 7 - Embedded Security Design Patterns

• Authentication and authorization methods, patterns, and technologies
• Solutions for ensuring system and software integrity
• Tamper protection, isolation, sandboxing, and memory protection
• Mechanisms and protocols for secure communication
• Hardware security modules, trusted platform modules, secure elements, and secure enclaves
• Hardware-supported security and anti-tamper protection