Diploma in Secure Boot, Hardening and A/B Updates
Online postgraduate diploma of 800 hours in Secure Boot, Hardening and A/B Updates: 8 modules covering device threat modelling, verified boot, OS hardening, data protection, A/B update schemes, update deployment and security testing, with an assigned technical tutor.
Diploma in Secure Boot, Hardening and A/B Updates — studying from Canada
Canada has a strong electronics and telecommunications sector, with clusters in Ottawa, often called Silicon Valley North, as well as Waterloo, Montréal and Vancouver. Companies such as Ciena, BlackBerry (QNX) and numerous semiconductor and embedded systems firms are based here, serving automotive, aerospace, defence and industrial markets. Research at institutions including Carleton University and the University of Waterloo supports advances in communications and microelectronics. Engineers design embedded hardware and software, RF systems and network equipment.
Fees for Canada: C$1,400 (Canadian dollar), with instalments and employer sponsorship available.
Relevant bodies in Canada
Typical roles
Questions from Canada
Do Canadian bodies accept electronics or telecom qualifications from private schools?
Electronics and telecom engineers who need the title in Canada typically obtain a Professional Engineer licence from a provincial association, such as Professional Engineers Ontario, based on accredited education and experience. SEIUM's qualifications are private, not official state degrees and not accredited by a national body, so they do not confer licensing. Recognition is up to employers or the relevant body.
Are Canadian electronics and telecom employers likely to value this training?
Canada has strong electronics, embedded and telecom employers, including in Ottawa, Montreal and the Greater Toronto Area. Hiring managers usually focus on technical interviews, projects and certifications where relevant. A SEIUM final project can evidence your skills, but whether a private qualification is valued depends on each employer, so ask prospective employers directly.
Is the course manageable with a job, and how are costs handled?
The programmes are fully online and flexible, so you can study from Canada or abroad without needing a student visa, around your working hours. Specialist courses take 300 hours, postgraduate diplomas 800 and master's 1,900. Teaching is in English, with an assigned technical tutor. Fees are payable in instalments, and employer sponsorship may be possible.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Build threat models for embedded devices.
Implement verified boot from the root of trust.
Harden the operating system with access controls and isolation.
Protect stored data through encryption and integrity mechanisms.
Design A/B update schemes with automatic rollback.
Deploy updates securely across device fleets.
Verify device security against the applicable standards.
Who it's for
- Embedded security engineers responsible for protecting devices from boot to field updates.
- Embedded Linux engineers building secure, maintainable system images.
- OTA update architects designing robust update and rollback strategies.
- Product cybersecurity analysts preparing products for the Cyber Resilience Act and IEC 62443.
- Security validation engineers who test and audit embedded firmware.
- Product security managers overseeing compliance and vulnerability handling.
- Engineering or science graduates looking to move into the automotive sector.
What you'll work with
- IEC 62443-4-2:2019 (technical security requirements for industrial automation components)
- NIST SP 800-193 (Platform Firmware Resiliency Guidelines)
- Regulation (EU) 2024/2847 (Cyber Resilience Act)
- ETSI EN 303 645 (cyber security for consumer IoT)
- UN Regulation No. 156 – UNECE R156 (software updates and update management systems for vehicles)
- ISO/SAE 21434:2021 (road vehicle cybersecurity engineering)
- UEFI Specification 2.10 (firmware interface and Secure Boot)
- U-Boot (verified boot)
- RAUC
- SWUpdate
- Mender
- Lynis
8 modules
1.1Attack surface of an embedded system1.2STRIDE analysis and attack trees1.3Assets, adversaries and security requirements1.4Security levels according to IEC 624431.5Essential requirements of the Cyber Resilience Act1.6Physical attacks: JTAG, UART and flash extraction1.7Remote attacks and persistence mechanisms1.8Defence in depth across the lifecycle1.9Documentation of traceable requirements1.10Case study: threats to an IoT gateway
2.1Root of trust and boot ROM2.2Verification of signed FIT images in U-Boot2.3UEFI Secure Boot, shim and db/dbx keys2.4High Assurance Boot on NXP i.MX2.5Signing the kernel, initramfs and device tree2.6Custody of signing keys in an HSM2.7dm-verity for rootfs integrity2.8Key revocation and rotation2.9OTP fuses and device lockdown2.10Lab: signed FIT chain in U-Boot
3.1Secure kernel configuration according to KSPP3.2Reducing services and exposed surface3.3Mandatory access control: SELinux and AppArmor3.4Seccomp, capabilities and namespaces3.5Read-only and noexec mounts3.6Accounts, passwords and SSH access3.7Firewalling with nftables3.8Disabling debug interfaces3.9Auditing with Lynis and CIS Benchmarks3.10Practical: hardening a Yocto image
4.1Partition encryption with dm-crypt and LUKS4.2Hardware-bound keys4.3Block integrity with dm-integrity4.4Storage of secrets and certificates4.5Secure erasure and end of life4.6Power-loss-resilient file systems4.7Separation of user and system data4.8Protection against offline attacks4.9Log management and privacy4.10Workshop: encrypted partition with automatic unlocking
5.1A/B partitioning versus recovery mode5.2Boot counters and bootcount in U-Boot5.3Automatic rollback on failure5.4Delta and block-based updates5.5Atomicity in the event of power interruptions5.6Updating the bootloader and firmware5.7Flash size and layout strategies5.8Post-update health checks5.9Backward compatibility of data5.10Lab: A/B slots with RAUC and bootcount
6.1Comparison of RAUC, SWUpdate and Mender6.2Signed bundles and their verification6.3Deployment servers: hawkBit and Mender Server6.4Campaigns, groups and staged rollout6.5Secure transport and mutual authentication6.6Integration with Yocto and CI6.7Fleet monitoring and telemetry6.8UNECE R156 requirements for vehicles6.9Handling mass failures in the field6.10Practical: staged rollout with hawkBit
7.1Penetration testing of embedded systems7.2Fuzzing of interfaces and protocols7.3Firmware analysis with binwalk7.4Fault injection testing7.5ETSI EN 303 645 compliance assessment7.6Vulnerability management and coordinated disclosure7.7Update regression testing7.8Evidence for certification7.9Continuous improvement of the security posture7.10Case study: audit of an industrial router
8.1Product threat model8.2Design of the verified boot chain8.3Hardening of the system image8.4A/B update scheme8.5Rollback and power-cut testing8.6Security assessment and findings8.7Field maintenance plan8.8Regulatory compliance report8.9Report and presentation8.10Final project: final review with your tutor
How you'll learn
The programme is delivered 100% online on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. There are no fixed timetables: you progress at your own pace within the intake, so you can combine it with your job.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is U-Boot (verified boot), RAUC, SWUpdate, Mender and Lynis, in free, academic or evaluation versions. Testing is studied through real procedures: rollback tests with power cuts, image hardening audits and firmware penetration tests. Assessment is continuous, module by module, plus the final project.
Standards covered: IEC 62443-4-2:2019, NIST SP 800-193 (Platform Firmware Resiliency Guidelines), Regulation (EU) 2024/2847 (Cyber Resilience Act), ETSI EN 303 645, UN Regulation No. 156 (UNECE R156), ISO/SAE 21434:2021 and UEFI Specification 2.10.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- An internet connection and a computer capable of running the programme software.
- English sufficient to read technical standards.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours over 6–8 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.
You work with U-Boot (verified boot), RAUC, SWUpdate, Mender and Lynis, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.
A SEIUM Institute diploma, awarded on passing the continuous assessment and the final project. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.
Yes. Modules passed are recognised in a higher programme in the same area (postgraduate diploma or master's). Ask about the recognition policy when you enrol.
Prior technical training or professional experience in the sector (no university degree required), a computer able to run the programme software and English sufficient to read technical standards.
Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.
Related programmes
Diploma in Digital Filters, FFT and Spectral
Online postgraduate diploma of 800 hours in Digital Filters, FFT and Spectral Analysis: 8 modules covering discrete signals and systems, FIR and IIR filter design, the…
Postgraduate Diploma in Beam Management and 6G Architectures
Online 800 h Postgraduate Diploma in Beam Management and 6G Architectures. 8 modules covering 3GPP TS 38.214, 3GPP TS 38.213 and MATLAB 5G Toolbox. Assigned tutor…
Postgraduate Diploma in Device APIs and Versioning
800-hour online Postgraduate Diploma in Device APIs and Versioning. 8 modules covering OMA LwM2M v1.2, IETF RFC 7252 (CoAP) and Zephyr RTOS. Assigned tutor and enrolment…
More in Electronics, Embedded Systems & Telecom
All Electronics, Embedded Systems & Telecom programmes → · How to apply · Fees & financing · Scholarships