Comments on: Security training for embedded developers?

Question: Security training for embedded developers?

RobotVoodooPower — Mon, 09 Feb 2009 11:04:35 -0800

What's a good security course for embedded developers?

The folks at the top say we need "security training". The server guys are taking a course in SQL injection, ASP.NET stuff, etc. I'd rather get my embedded guys something more, well, embedded-specific. I'm thinking a refresher on basics of cryptography, network security, specific protocols, etc. and maybe some "code practices greatest hits". A short two-day course is the target. Does anyone have a recommendation for either online/onsite training that might fit the bill?

By: pdxpatzer

pdxpatzer — Mon, 09 Feb 2009 11:34:35 -0800

Read Security Engineering: A Guide to Building Dependable Distributed Systems, 2nd Edition.

By: doteatop

doteatop — Mon, 09 Feb 2009 11:36:21 -0800

What platforms do they develop for? Frequently with embedded software on phones or PDAs, for example, the manufacturer will offer platform-specific security training.

By: RobotVoodooPower

RobotVoodooPower — Mon, 09 Feb 2009 12:01:14 -0800

doteatop, we develop against Windows CE and Linux. I'd like to remain platform-agnostic if possible, because my main goal is not to teach specific API behaviors but to satisfy the PHBs at my company while at the same time getting the developers excited about learning something new.

By: doteatop

doteatop — Mon, 09 Feb 2009 14:51:20 -0800

I can strongly recommend Fortify's training, and Cigital is highly spoken of as well.

Your developers might also appreciate putting into place some form of automation to check for memory management bugs, etc, during the build. If you have flexibility in your spending, maybe you can check out some affordable static analysis tools or fuzzer suites, and look for training more specific to those. I personally love build automation and this would get me really excited (management never or rarely expresses interest in these kinds of solutions).

For books, in addition to the above I can recommend: