Roadmaps Security roadmaps Application, engineering and product security

Hardware and Firmware Security

Secure the layers beneath the operating system: secure boot, UEFI, TPMs, hardware roots of trust, trusted execution environments, firmware analysis and side channels.

Estimated time: 15–30 months · At about 10 hours a week.

Learning path

Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.

Core topic
Optional
Done
In progress
Skip

Beginner · 2–4 months Below the operating system
Intermediate · 3–6 months Firmware analysis and platform security
Advanced · 4–8 months TEEs, side channels and hardware design
- Hardware-rooted security strategy
- Certification and evaluation
Expert · 6–12 months Leading hardware security
- Research and disclosure

All topics in detail

Beginner, Time: 2–4 months

Below the operating system

Skills

Explain the boot chain and where trust is established.
Describe secure boot, TPMs and hardware roots of trust.
Recognise firmware and hardware attack patterns.

Hands-on projects and labs

Enable and inspect secure boot and TPM state on a lab machine; read the measurement log.
Dump and inspect a UEFI image from a lab system with UEFITool.

Done when you can…

Explain how secure boot and measured boot protect a system and how they fail.
Inspect a firmware image and identify its components.

Beginner

How a computer boots

From power-on through firmware, bootloader and kernel. Each stage trusts the one before; secure boot is about making that trust verifiable.

Resources

BIOS Protection Guidelines (SP 800-147) Docs, Free, NIST

Beginner

UEFI and firmware

UEFI replaced the old BIOS and is a small operating system in its own right. Learn its structure, variables, drivers and attack surface.

Resources

UEFI Specification Docs, Free, UEFI Forum

Beginner

Secure boot

Each boot stage verifies the next against trusted keys. Learn the key hierarchy, how it is enforced and how it has been bypassed.

Resources

Platform Firmware Resiliency Guidelines (SP 800-193) Docs, Free, NIST

Beginner

Trusted Platform Modules

A TPM stores keys and measurements securely and enables disk encryption, attestation and device identity. Learn what it can and cannot protect.

Resources

TPM 2.0 Library Specification Docs, Free, Trusted Computing Group

Beginner

Hardware roots of trust

Immutable code and keys in silicon anchor the whole chain. Learn how device identity, measured boot and attestation build on them.

Resources

Hardware-Enabled Security (NIST IR 8320) Docs, Free, NIST

Beginner

Hardware and firmware threats

Bootkits, firmware implants, malicious peripherals and supply chain tampering. Study the real cases to see what defenders are up against.

Resources

Pre-OS Boot (MITRE ATT&CK T1542) Docs, Free, MITRE

Intermediate, Time: 3–6 months

Firmware analysis and platform security

Skills

Extract, unpack and analyse firmware images.
Find and use debug interfaces in a lab.
Deploy and verify measured boot and attestation.
Assess firmware update mechanisms.

Hands-on projects and labs

Unpack a router firmware image with Binwalk and run EMBA against it; triage the findings.
Find the UART on a lab device, get a shell and document how to disable it.
Set up Keylime or a cloud attestation service and verify a machine's boot state.

Done when you can…

Produce a firmware security assessment of a device with findings and fixes.
Demonstrate remote attestation of a lab system.

Intermediate

Extracting and unpacking firmware

Get firmware from update files, flash chips or vendor sites, and unpack it to see file systems, binaries and keys. Binwalk is the usual start.

Resources

Binwalk Tool, Free, ReFirmLabs

Intermediate

Analysing firmware

Look for hardcoded credentials, outdated components, insecure services and weak update checks. Automated tools find the obvious; reverse engineering finds the rest.

Resources

EMBA firmware analyser Tool, Free, EMBA project

Intermediate

Debug and physical interfaces

JTAG, SWD, UART and SPI give deep access to devices. Learn to find and use them in a lab, and how to lock them down in production.

Resources

Hardware Attack Surface (OWASP IoT) Docs, Free, OWASP Foundation

Intermediate

Measured boot and attestation

Measurements of each boot stage, stored in the TPM, let a remote party verify the device booted the expected software. This is how zero trust reaches hardware.

Resources

Keylime Tool, Free, Keylime project

Intermediate

Firmware update security

Signed updates, rollback protection and recovery paths keep firmware trustworthy for a device's lifetime. Unsigned updates are a classic weakness.

Resources

Platform Firmware Resiliency Guidelines (SP 800-193) Docs, Free, NIST

Intermediate

Firmware vulnerabilities in practice

Study published UEFI, baseboard controller and bootloader flaws. They show the patterns that keep recurring across vendors.

Resources

Firmware security research Docs, Free, Binarly

Advanced, Time: 4–8 months

TEEs, side channels and hardware design

Skills

Design and evaluate TEE-based systems.
Assess side-channel and fault-injection risk.
Specify secure hardware and firmware designs.
Manage hardware supply chain risk.

Hands-on projects and labs

Deploy a workload in a confidential VM and verify its attestation report.
Reproduce a published side-channel demonstration on lab hardware you own.
Write a hardware security specification for a new device.

Done when you can…

Show a confidential computing deployment with verified attestation.
Produce a hardware security design review with side-channel considerations.

Advanced

Trusted execution environments

Intel SGX and TDX, AMD SEV-SNP and Arm TrustZone and CCA isolate code and data from the rest of the system. Learn their models and limits.

Resources

Confidential Computing Consortium Docs, Free, Linux Foundation

Advanced

Confidential computing in practice

Run workloads in hardware-isolated VMs or enclaves in the cloud, with attestation proving what is running. Know the use cases and the operational cost.

Resources

Azure confidential computing Docs, Free, Microsoft

Advanced

Side-channel attacks

Timing, power, cache and speculative execution leak secrets without breaking any logic. Understand the classes and the mitigations at hardware and software level.

Resources

Side-channel attacks overview (Spectre and Meltdown) Docs, Free, Graz University of Technology

Advanced

Fault injection and glitching

Voltage and clock glitches, and electromagnetic faults, can skip security checks. Learn how they work, what defends against them, and test in a lab you own.

Resources

ChipWhisperer Tool, Free, NewAE Technology

Advanced

Secure hardware and firmware design

Design in secure boot, key storage, debug locking and update security from the start. Retrofitting hardware security is rarely possible.

Resources

Platform Security Architecture Docs, Free, Arm

Advanced

Hardware supply chain

Counterfeit chips, tampered boards and compromised firmware in the supply chain are hard to detect. Learn the verification and procurement controls.

Resources

Cybersecurity Supply Chain Risk Management (SP 800-161) Docs, Free, NIST

Expert, Time: 6–12 months

Leading hardware security

Skills

Set hardware-rooted security standards.
Navigate certification and hardware disclosure.

Hands-on projects and labs

Write a fleet-wide device identity and attestation strategy.
Plan a certification route for a product and estimate its cost.

Done when you can…

Lead hardware and firmware security for a product line or fleet.
Contribute a responsibly disclosed hardware or firmware finding.

Expert

Hardware-rooted security strategy

Set the standards for device identity, attestation, firmware integrity and confidential computing across the organisation's fleet and products.

Resources

Hardware-Enabled Security (NIST IR 8320) Docs, Free, NIST

Expert

Research and disclosure

Hardware flaws take years to fix and affect many vendors. Learn how coordinated disclosure works at this level and contribute responsibly.

Resources

The CERT Guide to Coordinated Vulnerability Disclosure Docs, Free, CERT/CC

Expert

Certification and evaluation

Common Criteria, FIPS 140 and PSA Certified give assurance for hardware and crypto modules. Know when they are worth the cost.

Resources

Common Criteria Docs, Free, Common Criteria Portal

Overview

Everything above the hardware trusts it. Firmware runs before the operating system, hardware roots of trust anchor identity and encryption, and trusted execution environments protect data even from a compromised OS. Flaws here are hard to detect and often impossible to patch.

The field covers secure boot chains, UEFI and firmware analysis, TPMs and hardware security modules, confidential computing, side-channel attacks and the physical interfaces used to debug and attack devices. It needs low-level systems knowledge and a willingness to work close to the metal.

Why it matters

Firmware implants, bootkits and hardware-level attacks persist through reinstalls and evade most defences. As confidential computing and hardware roots of trust spread, organisations need people who understand and can verify the foundations.

Typical job roles

Mid-levelFirmware security engineer Analyses and hardens firmware and boot chains.
SeniorHardware security engineer Designs and tests secure hardware and TEEs.
SeniorPlatform security architect Sets hardware-rooted security for devices and servers.
SeniorHardware security researcher Finds and reports hardware and firmware flaws.

Prerequisites

Operating system and computer architecture fundamentals.
C and some assembly; comfort reading low-level code.
Cryptography basics: hashing, signatures and keys.
Some electronics is helpful for physical work.

Cybersecurity fundamentals Foundations of computer science

Tools and technologies

Binwalk Open source Extract and analyse firmware images.
EMBA Open source Automated firmware security analysis.
UEFITool Open source Inspect and edit UEFI images.
CHIPSEC Open source Platform security assessment framework.
Keylime Open source Remote attestation with TPMs.
ChipWhisperer Open source Side-channel and fault-injection research hardware.

Certifications

Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.

Intermediate GIAC GREM GIACReverse engineering skills that transfer to firmware.
Advanced CISSP ISC2Broad grounding; no mainstream hardware-specific certification.Cost and exam details

Resources

Platform Firmware Resiliency Guidelines (SP 800-193) Docs, Free, NIST
Hardware-Enabled Security (NIST IR 8320) Docs, Free, NIST
Confidential Computing Consortium Docs, Free, Linux Foundation
TPM 2.0 Library Specification Docs, Free, Trusted Computing Group
OWASP Internet of Things Project Docs, Free, OWASP Foundation

Frameworks and standards

FIPS 140-3 (Security Requirements for Cryptographic Modules) The standard that cryptographic modules, such as HSMs, are tested and validated against.
NIST SP 800-161 (Cybersecurity Supply Chain Risk Management) How to identify and manage cybersecurity risks from suppliers and the products and services they provide.
NISTIR 8259 (IoT Device Cybersecurity Capabilities) Foundational security activities and capabilities for makers of IoT devices.
ETSI EN 303 645 The European baseline security standard for consumer IoT devices.
NIST SP 800-207 Zero Trust Architecture Defines zero trust: never trust a request because of where it comes from, check identity and context every time.

All frameworks and standards

Career path

A common progression. Titles vary between companies.

Embedded, systems or security engineer0–4 years
Firmware security engineer3–6 years
Hardware security engineer or researcher6–10 years
Platform security architect10+ years

Related domains to move into

All security roadmaps Back to top

Last reviewed: 27 October 2026. Found a mistake, or want a roadmap written sooner? Contact