Course Outline
- BMC Threat Model.
- Attack surface analysis of server BMCs.
- Common vulnerabilities in legacy BMC firmware.
- Overview of OpenBMC security architecture.
- Compliance requirements (NIST, PCI-DSS).
Secure Boot
- U-Boot verified boot chain.
- Image signing using RSA and ECDSA.
- Key hierarchy and revocation processes.
- Introduction to measurement and attestation.
Firmware Update Security
- Flow of image signature verification.
- Rollback protection and version policies.
- Dual-bank update strategies.
- Code updates via Redfish and IPMI.
Certificate Management
- Architecture of Phosphor-certificate-manager.
- Installing and replacing HTTPS certificates.
- Certificate Authority (CA) trust stores.
- LDAPS and client certificate authentication.
Authentication and Authorization
- Local user management and password policies.
- Integration with LDAP and Active Directory.
- PAM stack configuration.
- Redfish RBAC and privilege mapping.
Network Security
- Firewall rules and nftables.
- TLS 1.3 configuration in bmcweb.
- SSH hardening and key-based authentication.
- Network segmentation for BMC interfaces.
Audit and Response
- Remote syslog configuration.
- Security event logging.
- SEL and audit trail management.
- Incident response procedures for compromised BMCs.
Security Testing
- Static analysis using CodeQL and Bandit.
- Fuzzing D-Bus interfaces.
- Penetration testing of REST and Redfish APIs.
- CVE tracking and patch management.
Requirements
- Familiarity with PKI and TLS fundamentals.
- Basic understanding of Linux security concepts.
- Knowledge of embedded firmware update mechanisms.
Audience
- Security engineers.
- Firmware developers.
- System administrators managing BMC infrastructure.
Testimonials (4)
The trainer was helpful..
Attila - Lifial
Course - Compliance and the Management of Compliance Risk
The report and rules setup.
Jack - CFNOC- DND
Course - Micro Focus ArcSight ESM Advanced
I understood the process of the operating system and how do we link all factors together information of network as well so now I have an obvious and full picture about what is going on these computers how they communicate with each others ultimately gained knowledge about the most important operating system which is Linux and how do we implement our own embedded Linux
Rawda Alnaqbi - beamtrail
Course - Introduction to Embedded Linux (Hands-on training)
The knowledge of the trainer. He was able to answer all of my questions, even questions about our platform. He also continued to help until we all understood the material.
