Introduction

Product Evaluation and Certification is a key component in ensuring the resilience of critical infrastructure, by providing assurance that security is built into products at the design stage rather than included as an afterthought.  The Common Criteria (CC), de facto standard for product evaluation, defines a common set of security functions which product developers use to establish the security requirements of their IT products in a standardised language.

In collaboration with and conducted by Cyber Security Agency of Singapore, this course introduces the principles and methodologies for Security Evaluation, for hardware and embedded systems security. Through coursework and hands-on experience, researchers/engineers/product developers who want to understand or consider a future career in security evaluation and certification can benefit from taking this course.

Objectives

At the end of the course, learners are able to:

• Understand security assurance requirements through case studies and;
• Understand the scope and techniques for vulnerability assessment of hardware products.

Who should attend

Specifically for learners who would like to understand security evaluation and interested in future career advancement or training related to security evaluation and certification.

Such knowledge can be applicable in jobs related to hardware design, roles in certification or evaluation labs, forensic investigator, vulnerability assessment analyst etc.

Introduction

Emerging Cyber Physical Systems and Internet of Things systems are characterized by the interaction between the physical world and the cyber world. With the growing importance of communication, storage and sensor/actuators in such systems, hardware security is playing a major role in contrast with traditional IT security.

In this course, we will learn about the basics for key management through hardware security module and discuss various aspects of hardware security (crypto accelerator, root-of-trust, secure storage, physical and side-channel attacks) in the backdrop of different applications and industries.

Objectives

At the end of the course, learners are able to:

• Understand industrial and academic demands of emerging concepts of cyber security and;
• Appreciate the increasing role of hardware security in the context of various cyber physical systems.

Who should attend

Specifically for learners who would like to understand how emerging Cyber Physical Systems and Internet of Things systems will impact cybersecurity and how to manage them in various industries and applications.

Such knowledge can be applicable in jobs related to hardware design, roles in certification or evaluation labs, forensic investigator, vulnerability assessment analyst etc.

Introduction

Integrated circuits (IC) are key parts of any electronics system, controlling the main functions of the system or storing critical information (e.g. IPs, encryption key, personal data).

In this course, you will first learn about the basics of an integrated circuit (IC) layout and how data are stored in an IC chip. You will then learn of various IC hardware security analysis approaches, covering non-invasive/semi-invasive/invasive techniques in sample preparation, imaging, content extraction and data analysis. Lastly, there will be lab sessions for you to apply some of these techniques. 

Course Introduction Video: https://youtu.be/qWcPg22Qvqw

Objectives

At the end of the course, learners would:

• Have a basic understanding and some hands-on experience on hardware security analysis via chip analysis (PCB & IC) and;
• Be able to design experiments or devise plans to tackle hardware security problems in ICs.

Who should attend

Specifically for learners who would like to know hardware assurance through PCB/IC analysis, be trained in hardware assurance or considering a future career advancement in related domain.

Such knowledge can be applicable in jobs related to hardware design, roles in certification or evaluation labs, forensic investigator, vulnerability assessment analyst etc.

Introduction

The course is related to the Design for Trust for integrated Circuits (IC). We will first give an overview on the hardware security risk and the roots of trust in ICs. Thereafter, we will cover the various Design for Trust issues, techniques and analyses at various levels, spanning from the manufacturing, chip, netlist, design, and layout levels. Particularly, the manufacturing security includes split manufacturing; the chip level security includes watermarking, fingering, and metering; the netlist security includes logic locking and trojan analysis; the design security includes security primitives (e.g. encryption, random number generators, physical unclonable functions, etc.); and the layout level includes camouflaging.

Objectives

At the end of the course, learners are able to:

• Understand the security risks and protection techniques at different levels, spanning from firmware/algorithm, manufacturing, chip level, netlist level, design level, and layout level;
• Understand the figures-of-merits and parameters to qualify and quantify the security levels at different levels and;
• Understanding the trade-offs between security and the costs (in terms of performance, power, area, design efforts).

Who should attend

Specifically for learners who would like to know ‘Design for Trust’ on Hardware, be trained in ‘Design for Trust’ to address Hardware Security Issues and/or considering future career advancement in related domain.

Such knowledge can be applicable in jobs related to hardware design, roles in certification or evaluation labs, forensic investigator, vulnerability assessment analyst etc.

Introduction

An accomplished hacker can alter device behavior by injecting faults to extract encryption keys or bypass security checks. These faults can be injected through variety of techniques like glitching, high-energy impulses etc. Further the cost-effective practice of outsourcing can introduce untrusted parties in the long chain of supply, creating additional vulnerabilities in the end-product.  

In this course, we will study two emerging threats to electronic systems namely fault injection attacks and Hardware trojan. The course will span over basics of fault-injection attacks, its injection and analysis techniques, countermeasures and implications. It will also shed light on Hardware trojan as a by product of untrusted supply chain, it taxonomy and detection methods.

Objectives

At the end of the course, learners are able to:

• Compare different trojan detection mechanisms and describe their applicable scenarios and;
• Describe tools and algorithms used for trojan detection and prevention.

Who should attend

Specifically for learners who would like to understand fault attacks and gain practical experience in the field of attacks.

Such knowledge can be applicable in jobs related to hardware design, roles in certification or evaluation labs, forensic investigator, vulnerability assessment analyst etc.

Introduction

Modern electronic devices may leak sensitive credentials like passwords, encryption keys etc unintentionally through various channels like timing information, power consumption, electromagnetic emanation etc. leading to vulnerabilities better known as side-channel attacks. A deep understanding of these vulnerabilities will lead to an eco-system of well-thought secure systems.

In this course, we take a deep dive into side-channel attacks. We will learn the about side-channel attacks on modern cryptography, its various types, modus operandi, protection mechanisms, certifications and alternate applications. All key concepts will be complemented with extensive hands-on exercises for an advanced understanding of the topic. 

Objectives

At the end of the course, learners are able to:

• Various SCA evaluation techniques and SCA countermeasures;
• Practical hands-on experiences on various popular SCA methods (DPA and CPA) and;
• Through the use of the Side-Channel Attack Toolkit from Async2Secure Pte Ltd, to gain in-sight understanding how to qualify or quantify SCA based on various parameters including the setup parameters (in software and hardware), design parameters (various implementations), attacking models, and attacking techniques.

Who should attend

Specifically for learners who would like to know SCA and gain practical experience in the field of SCA.

Such knowledge can be applicable in jobs related to hardware design, roles in certification or evaluation labs, forensic investigator, vulnerability assessment analyst etc.

Introduction

Quantum computers are able to tackle certain problems much faster than classical computers, benefiting several industries including healthcare, finance, manufacturing etc. However, quantum computers could potentially break classical cryptography in a fraction of the time. As a result, there is a push to prepare migration towards quantum safe cryptography. Post quantum cryptography (PQC) is a fore running candidate for quantum safe cryptography. By transitioning to PQC, one can ensure the continued security of our sensitive data in the quantum age. Potentially an essential technology area in time to come, learners acquire necessary background in the post-quantum cryptography and have the foundational knowledge required to be prepared for quantum migration for their business and their customers.

Objectives

At the end of the course, learners are able to:

• Master the fundamentals: Gain a solid understanding of the threat quantum computing poses to current cryptography and the functionalities of key quantum algorithms.
• Navigate PQC standards: Explore the National Institute of Standards and Technology (NIST) PQC competition process, winning algorithms, and their underlying mathematical principles.
• Implement PQC solutions: Learn how to integrate PQC algorithms into the TLS protocol and build applications using NIST-approved solutions from the Open Quantum Safe Project (OQS).
• Start thinking about your PQC migration: Identify challenges and be prepared for a strategic plan for a secure transition from current cryptography to PQC, including key management strategies.

Who should attend

Industries which are in Information and Communication Technology (ICT), or relies on ICT especially Banking & Finance, Healthcare, Automotives, etc. as well as Government Agencies. Also good for roles such as:

• Decision makers and planners, such as Executives, Board members System architect, Cyber security leads
• Implementers and consultants, such as Integration engineers and Technology consultants
• Application developers, System administrators, Network engineers 
• Security professionals at various levels

Introduction

Operational Technology (OT) consists of computer-driven components of a critical infrastructure, which manages customized, physical-world protocols. Traditionally, OT security would consist of defining hard-to-breach, physical perimeters and corresponding access control techniques. However, with deep penetration of communication networks, and thereby, IT systems in the OT networks is blurring the hard boundary of IT and OT worlds. As a result, the security of OT layer in a system needs to be redefined and methodically studied considering new threats. The objective of this course is to introduce the concepts of IT and OT in the context of CPS/IoT systems; followed by defining the security solutions and practices for OT.

Objectives

At the end of the course, learners will achieve the following understanding:

• Differentiate between IT and OT layer
• Security objectives for OT layer and cryptographic techniques to achieve that
• OT security solutions and best practices
• Application of the concepts in small-scale laboratory setup

Who should attend

Professionals involved in environments where industrial systems and critical infrastructure are used. OT includes systems like SCADA, PLCs, DCS, and other industrial control systems (ICS), often found in sectors such as energy, manufacturing, utilities, transportation, and more.

Introduction

To provide a practical introduction in the aspects of hardware analysis, including deep learning techniques. The course involves both lectures and practical hands-on. 

Objectives

At the end of the course, learners will be able to:

• Name and describe the major steps involved in realizing an integrated circuit (IC) from specification to physical chip
• Name and differentiate common image analysis/computer vision tasks; differentiate machine-learning and deep-learning methods; name and describe common AI/deep-learning methods/models for image analysis tasks
• Define graph and identify types of data that can be represented as graphs; name and describe common graph analysis methods; name and describe the operation of the most common type of graph neural network
• Describe the rationale for layout to schematic and standard cell recognition. Name and describe the common process used for layout to schematic and standard cell recognition; discuss the challenges involved in the process and possible mitigation strategies
• Describe the rationale for circuit interconnect extraction. Name and describe AI-based methods used for circuit interconnect extraction; discuss the challenges involved in the process and possible mitigation strategies
• Describe the rationale for netlist generation and analysis. Name and describe the common methods used for netlist analysis; discuss the challenges involved in the process and possible mitigation strategies

Who should attend

Professionals, researchers, and students working at the intersection of semiconductor design, hardware security, reverse engineering, machine learning and forensics and IP protection.

Introduction

To provide a practical introduction in the aspects of Hardware Trojan threats and detection techniques using machine learning methods. The course involves both lectures and practical hands-on.

Objectives

At the end of the course, learners will be able to:

• Name and describe the security threats related to Hardware Trojan.
• Name and differentiate common Hardware Trojan types and designs.
• Name and differentiate common Hardware Trojan countermeasures.
• Describe the rationale for invasive Hardware Trojan detection techniques.
• Describe common machine learning techniques used in Hardware Trojan detection.

Who should attend

Professionals and researchers involved in hardware security, especially those working with integrated circuits (ICs), system-on-chip (SoC) design, and trustworthy computing systems.