Security education on a budget: getting the most "bang for the buck" with limited time and resources

• Authors: Crystal Edge;John Stamey
• Venue: 2010 Information Security Curriculum Development Conference
• Year: 2010

Recently, general understanding of the importance of system security has increased and has been reflected in undergraduate and graduate curricula that offer security courses. These security education components are certainly a step in the right direction and should contribute to increased attention to security during the design and development phases of software and system engineering. However, the importance of system security is not always reflected in the quantity of required security courses or the budget allocated for such courses. One way for getting the most "bang for the buck" when it comes to security education is to have a small set of concentrated security courses that pair hands-on labs and lasting security principles; then, augment these security courses with additional security components and activities in other required courses from the curriculum. To provide education that is both relevant now and in the future, we use a principles-based approach together with hands-on security labs. We offer seven strategies for making this approach successful. Based on direct observation, student surveys, anecdotal evidence, and job placement, we believe that this approach has been successful in producing graduates both conscious of security issues and capable of designing and developing secure systems.