Individual Certification
Digital Attestation Security Engineer
For engineers who design, build, and verify systems that rely on remote attestation. The certification is issued by CCSI to candidates who pass both a written exam and a practical lab.
Body of knowledge
1. Hardware roots of trust
- TPMs, secure boot, and measured boot
- TEE architectures: process enclaves vs. confidential VMs
- TCB composition and firmware/microcode versions
2. Attestation protocols
- Evidence, endorsements, and reference values
- Passport and background-check models
- Quote formats, certificate chains, and collateral
- Freshness, nonces, and replay protection
3. Verifier engineering
- Writing and versioning appraisal policy
- Measurement allow-lists and reproducible builds
- Handling TCB recovery and revoked platforms
4. Secrets and key release
- Attestation-bound key release with KMS/HSM
- Secure channels terminated inside the enclave
- Sealing, migration, and rotation
5. Cloud confidential computing
- AWS Nitro Enclaves and attestation documents
- Google Cloud Confidential VMs and Confidential Space
- Confidential containers and Kubernetes
6. Threats and assurance
- Side channels and host-level attacks
- Supply-chain compromise of enclave images
- Vulnerability response for TEEs and dependencies
- Logging and evidence for auditors
Exam outline
The exam has two parts. Both must be passed to earn the certification.
| Part 1: Written exam domain | Weight |
|---|---|
| Hardware roots of trust | 15% |
| Attestation protocols | 20% |
| Verifier engineering | 20% |
| Secrets and key release | 15% |
| Cloud confidential computing | 15% |
| Threats and assurance | 15% |
Part 2: Practical lab
- Build a verifier that appraises attestation evidence against a policy
- Gate a secret’s release on a verified measurement
- Detect and reject a tampered or out-of-date enclave image
- Write up findings as an auditor-ready report
Recertification is required every three years.