Educating Students to Create Trustworthy Systems

A look at software engineering risks in a team project course

“…Hence, risk management is an essential topic in any software engineering course. There are many ways to introduce the concept of risk management to the class, such as using games [14], risk assessment tools [7], or educational case studies [10] [13]. In our CSCI577-graduate level software engineering class, as part of the software development process, student teams learn how to identify, analyze, mitigate and manage the risks in their real-client team projects [5].…”

Embedding Secure Programming in the Curriculum: Some Lessons Learned

“…Swart and Erbacher [13] point out that "Dealing with epidemic-style attacks will require focused effort in software engineering to develop secure code, but the solution will also require systems that account for the human factors that spread such attacks, including social engineering and end-user psychology".…”

A method for incorporating usable security into computer security courses

“…In general, computer security instructors tend to focus [15] on topics such as access control, encryption, security models, etc., while Certified Information Systems Security Professionals (CISSP) cite their top five priorities as: upper management support, user awareness and training, malware, patch management, vulnerability and risk assessment. These were consistently ranked lower by the computer science faculty.…”

“…Consequently, many of the topics deemed important for the industry are not covered in a typical computer security course. In [15] it is argued that including risk assessment and modeling in traditional computer security courses can provide significant improvement and that students need background in HCI principles and Usable Security. We feel that CS faculty should consider broadening their topics list to include some of these areas.…”