Diploma in OTA Security and Edge Version Management
Online postgraduate diploma of 800 hours in OTA security and version management at the edge. 8 modules covering edge device life cycle, root of trust and secure boot, update cryptography, OTA mechanisms, version management, software supply chain and regulatory compliance, with an assigned technical tutor.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Understand the life cycle and attack surface of edge devices.
Implement secure boot with a hardware root of trust.
Apply sound cryptography to firmware signing and verification.
Design atomic and resilient OTA update mechanisms.
Manage versions and staged deployments with rollback.
Secure the software supply chain with SBOMs and signing.
Meet the regulatory requirements for product cybersecurity.
Who it's for
- Embedded security engineers protecting firmware from boot to update.
- IoT device engineers managing fleets in the field.
- DevSecOps engineers extending pipelines to edge devices.
- Product cybersecurity managers preparing for the Cyber Resilience Act.
- Edge systems architects designing update and deployment strategies.
- Firmware engineers implementing bootloaders and OTA clients.
- Engineering or science graduates looking to move into manufacturing.
What you'll work with
- Regulation (EU) 2024/2847 (Cyber Resilience Act)
- IEC 62443-4-1 (secure development life cycle)
- IEC 62443-4-2 (technical requirements for components)
- IETF RFC 9019 (SUIT firmware update architecture for IoT)
- NIST SP 800-193 (platform firmware resiliency)
- ISO/IEC 5962:2021 (SPDX)
- Directive (EU) 2022/2555 (NIS2)
- UNECE R156 (software update management systems)
- MCUboot
- Mender
- RAUC
- Sigstore Cosign
- Syft and Grype
8 modules
1.1Device types: sensors, gateways and edge servers1.2Firmware and software life cycle1.3Inventory and fleet management1.4Update architectures1.5Availability requirements on the shop floor1.6Intermittent connectivity and isolated networks1.7Edge attack surface1.8Manufacturer responsibilities1.9Cybersecurity regulatory landscape1.10Workshop: inventory of a device fleet
2.1Hardware root of trust2.2Secure elements and TPM 2.02.3Secure boot chain2.4Verification of firmware signatures2.5Anti-rollback protection2.6Secure key storage2.7Measured boot and remote attestation2.8Trusted Firmware-M architecture2.9Secure debugging and JTAG locking2.10Practical exercise: secure boot with MCUboot
3.1Digital signatures with ECDSA and Ed255193.2Hash functions and integrity verification3.3Encryption of firmware images3.4Public key infrastructure3.5Key management and rotation3.6HSM modules for signing3.7Post-quantum cryptography on the horizon3.8Common implementation errors3.9Device certificates3.10Lab: signing and verifying an image
4.1A/B partitions and atomic updates4.2Delta updates and compression4.3Resuming after power loss4.4TUF and Uptane frameworks4.5SUIT: IETF update manifests4.6Mender, RAUC and SWUpdate tools4.7Updating containers at the edge4.8Maintenance windows on the shop floor4.9Post-update health checks4.10Lab: A/B update with RAUC
5.1Semantic versioning of firmware and models5.2Compatibility between components5.3Staged and canary deployments5.4Deployment rings by criticality5.5Automatic health-based rollback5.6Per-device configuration management5.7GitOps at the edge5.8Real-time version inventory5.9Managing disconnected devices5.10Practical exercise: ring-based deployment with rollback
6.1Software bill of materials (SBOM)6.2SPDX and CycloneDX formats6.3Vulnerability and CVE management6.4Coordinated vulnerability disclosure6.5Reproducible and verifiable builds6.6Signing artefacts with Sigstore6.7Integrity levels of the SLSA framework6.8Third-party dependencies and licences6.9Communicating VEX6.10Case study: response to a critical vulnerability
7.1EU Cyber Resilience Act7.2Requirements of IEC 62443-4-1 and 4-27.3NIS2 Directive for operators7.4Logging and auditing of updates7.5Fleet security monitoring7.6Incident response at the edge7.7Penetration testing of OTA mechanisms7.8Support throughout the service life7.9Documentation for certification7.10Workshop: CRA compliance plan
8.1Product requirements and threats8.2STRIDE threat model8.3Secure boot design8.4Update mechanism design8.5Version management and deployment8.6SBOM and vulnerability management8.7Security validation8.8Compliance plan8.9Report and presentation8.10Final project: final review with the tutor
How you'll learn
Training is 100% online on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. There are no fixed timetables: you progress at your own pace within the intake, so the programme fits around your job.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is MCUboot, Mender, RAUC, Sigstore Cosign and Syft and Grype, in free, academic or evaluation versions. Exercises are based on real procedures: A/B updates with simulated power cuts, staged deployments with automatic rollback and vulnerability analysis based on the SBOM. Assessment is continuous by module, plus the final capstone project.
Standards covered: Regulation (EU) 2024/2847, IEC 62443-4-1, IEC 62443-4-2, IETF RFC 9019, NIST SP 800-193, ISO/IEC 5962:2021, Directive (EU) 2022/2555, UNECE R156.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- An internet connection and a computer capable of running the programme software.
- English sufficient to read technical standards.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours over 6–8 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.
You work with MCUboot, Mender, RAUC, Sigstore Cosign and Syft and Grype, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.
A SEIUM Institute diploma, awarded on passing the continuous assessment and the final project. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.
Yes. Modules passed are recognised in a higher programme in the same area (postgraduate diploma or master's). Ask about the recognition policy when you enrol.
Prior technical training or professional experience in the sector; no university degree is required.
Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.
Related programmes
Diploma in Policy Design with Monte Carlo Simulation
Online postgraduate diploma of 800 hours in policy design with Monte Carlo simulation. 8 modules covering Monte Carlo fundamentals, uncertainty modelling, variance reduction, policy evaluation, simulation-based…
Diploma in Drift Monitoring and Model Health
Online postgraduate diploma of 800 hours in drift monitoring and model health. 8 modules covering model degradation, statistical and sequential drift detection, label-free performance estimation, drift…
Diploma in FL Horizontal/Vertical and Orchestration
Online postgraduate diploma of 800 hours in horizontal/vertical federated learning and orchestration: 8 modules covering federated learning under IEEE 3652.1, horizontal FL, vertical FL, orchestration and…
More in Data, AI, Simulation & Analytics
All Data, AI, Simulation & Analytics programmes → · How to apply · Fees & financing · Scholarships