Platform security learning path

Linux kernel internals

Start where hardware, firmware, drivers, and security boundaries meet.

The Linux kernel connects hardware, firmware, drivers, memory, interrupts, devices, filesystems, networking, containers, and security boundaries. Kernel fluency makes it easier to reason about secure boot, device trust, DMA attacks, kernel exploitation, attestation, virtualization, and cloud infrastructure.

Best hands-on project: build and boot a custom Linux kernel in QEMU. Write a simple kernel module, add logging, expose a sysfs interface, and debug it with gdb, dmesg, ftrace, and perf.

BIOS, UEFI, and platform firmware

Understand the bridge between platform initialization and OS boot.

UEFI is essential for anyone working on Secure Boot, firmware signing, TPM measurements, capsule updates, boot policies, and root-of-trust systems.

Best hands-on project: build OVMF from EDK II, boot it in QEMU, enable Secure Boot, enroll custom keys, sign a bootloader, and inspect UEFI variables before and after boot.

TPM 2.0 and measured boot

Connect boot evidence to remote verification.

Secure Boot answers whether something was allowed to boot. Measured boot answers what actually booted. TPM-based attestation connects firmware state, bootloader state, kernel state, and remote verification.

Best hands-on project: use swtpm with QEMU, boot a Linux VM with a virtual TPM, inspect PCR values, seal a secret to specific PCRs, change the boot path, and observe unsealing fail when measurements change.

BMC, ILOM, Redfish, IPMI, PLDM, and MCTP

Study the out-of-band control plane for server security.

Baseboard management controllers control power, firmware updates, sensors, host recovery, remote console, inventory, and out-of-band management. Vendor stacks such as ILOM, iLO, and iDRAC are built around the same broad management concepts, even when implementations differ.

Best hands-on project: run OpenBMC in an emulated environment, interact with it using Redfish APIs, inspect D-Bus services, simulate host state transitions, and study how firmware update workflows are modeled.

Platform hardware foundations

Build the hardware model that firmware and kernel security rely on.

Platform security requires knowing how CPUs reset, how memory is initialized, how devices access memory, how interrupts are routed, and how privileged execution modes interact.

Best hands-on project: create a QEMU-based lab with OVMF, Linux, virtual PCI devices, and a virtual TPM. Trace the boot flow from firmware to bootloader to kernel, then inspect how devices appear through PCI enumeration, ACPI tables, and kernel logs.

Reverse engineering and firmware security

Learn to reason about opaque firmware and boot-chain attack surfaces.

Reverse engineering is essential for understanding closed firmware, bootloaders, binary drivers, and attack surfaces that are not visible from source code. It also improves review of firmware update mechanisms, cryptographic verification paths, and platform initialization logic.

Best hands-on project: extract an OVMF firmware image, identify firmware volumes, locate UEFI drivers, open modules in Ghidra, and trace how a selected DXE driver initializes.

Linux hacking, exploitation, and hardening

Pair offensive understanding with defensive kernel hardening.

Linux hacking should be approached from both offensive and defensive perspectives. The goal is not just to exploit bugs, but to understand why bugs exist, how attack surfaces are exposed, and how modern mitigations work.

Best hands-on project: write a deliberately vulnerable kernel module, trigger the bug from user space, observe the failure with KASAN enabled, then patch the module and verify the fix.

Conferences, talks, and community learning

Stay current through the communities publishing real-world lessons.

After the fundamentals, the fastest way to stay current is to follow communities where firmware, kernel, platform security, and cloud infrastructure engineers publish practical lessons.