SEC-110 · Kernel Security · Advanced
Exploit Mitigations & Hardening — full syllabus
The mitigations available in a modern kernel, what each actually stops, and what they cost.
Duration3 full days in person · 6 half-days online
Cohortmax 14 in person · 20 online
Pricefrom SAR 9,000 in person · local pricing per city
Delivery35% principles · 20% guided investigation · 45% engineering studio
Who this course is for
Kernel and platform engineers choosing which exploit mitigations to enable on a shipping product — who need to know what each one stops, what bypasses exist and what it costs.
Prerequisites
- Ability to configure, build and boot a kernel (QEMU is fine)
- C and enough assembly to follow an exploit write-up
- Basic x86-64 or arm64 architecture knowledge
Course outline
Day 1 — Execution-control mitigations
- KASLR: what it randomises, what it does not, and information-leak bypasses
- SMEP, SMAP and PAN: ret2usr and its modern descendants
- KPTI: the Meltdown fix and its syscall and context-switch overhead
- Stack protector and stackleak: strengths and gaps
- Kernel CFI: forward-edge coverage, clang CFI and what FineIBT-style schemes add
- Structure randomisation (randstruct) and its compatibility cost
Day 2 — Memory-safety and transient-execution mitigations
- Hardened usercopy: what CONFIG_HARDENED_USERCOPY catches at copy time
- Slab freelist hardening and pointer obfuscation; SLAB vs SLUB behaviour
- init_on_alloc/init_on_free and the detection story: KASAN, KFENCE
- Spectre/Meltdown class: retpolines, IBRS, mitigations= and measuring the overhead
- Reading the kernel's own hardening documentation and Kconfig defaults critically
Day 3 — Choosing and defending a baseline
- Cost accounting: boot time, latency and throughput per mitigation
- Attack-surface removal vs mitigation: what you fix by deletion instead
- Baseline profiles: general-purpose distro vs embedded product vs cloud host
- kconfig-hardened-check style audits and gap analysis
- Writing the hardening rationale document a security review will ask for
Hands-on labs
- Lab: Enable and boot-test KASLR, KPTI and stack-protector variants; measure the overhead of each
- Lab: Demonstrate a hardened-usercopy violation with a deliberately bad copy_to_user and read the splat
- Lab: Corrupt a slab freelist in a test module with and without freelist hardening; compare the outcomes
- Lab: Benchmark a workload with mitigations=off against your proposed baseline and present the cost table
- Lab: Audit a supplied defconfig against a hardening checklist and produce a gap list with justifications
Capstone project
Produce a hardening baseline for a stated product profile (gateway, automotive head unit or cloud host): a defconfig fragment, a measured cost table from your own lab benchmarks, a bypass-aware statement of what each chosen mitigation does and does not stop, and a written rationale you can defend in a security review.
What you leave with
- A mitigation-by-mitigation map: mechanism, bypass class, cost
- Overhead evidence from your own measurements, not vendor slides
- A defconfig fragment and rationale template reusable on products
- Fluency reading Kconfig hardening options and upstream hardening docs
Upcoming dates
| Dates | Where | Seats | Early bird | Regular | |
|---|---|---|---|---|---|
| 8 Nov – 10 Nov 20263 full days | RiyadhIn person · KAFD Conference Centre | 11 of 14 | SAR 8,100until 9 Oct | ||
| 15 Nov – 17 Nov 20263 full days | Kuwait CityIn person · Al Hamra Tower | 6 of 14 | KWD 670until 16 Oct | ||
| 22 Nov – 24 Nov 20263 full days | MuscatIn person · Knowledge Oasis Muscat | 11 of 14 | OMR 830until 23 Oct | ||
| 22 Nov – 29 Nov 20266 half-days | Gulf bandLive online · 09:00–13:00 GMT+3 | 7 of 20 | US$1,580until 23 Oct | ||
| 23 Nov – 25 Nov 20263 full days | OttawaIn person · Kanata North Tech Park | 6 of 14 | CAD 2,930until 24 Oct | ||
| 30 Nov – 2 Dec 20263 full days | TorontoIn person · MaRS Discovery District | 11 of 14 | CAD 2,930until 31 Oct | ||
| 30 Nov – 7 Dec 20266 half-days | Europe bandLive online · 09:00–13:00 CET | 12 of 20 | US$1,580until 31 Oct | ||
| 7 Dec – 9 Dec 20263 full days | LondonIn person · Shoreditch Works | 6 of 14 | GBP 1,680until 7 Nov | ||
| 7 Dec – 14 Dec 20266 half-days | Americas bandLive online · 13:00–17:00 ET | 17 of 20 | US$1,580until 7 Nov | ||
| 14 Dec – 16 Dec 20263 full days | BerlinIn person · Factory Görlitzer Park | 11 of 14 | EUR 1,990until 14 Nov |
Book a seat, or bring this course to your team
Seats can be reserved online; private delivery runs on-site or live online, adapted to your stack.
Questions about fit or prerequisites? Email hello@kernelsystems.academy. To save this syllabus, print this page to PDF from your browser.