0

I saw this question which discussed teaching Information Security as a mandatory course, with a focus on Computer Science discipline.

I have a different challenge at hand. I want to create an Information Security course which can be offered as an "Open course" to any student in my University coming from any stream in Science or Engineering.

The goal of this course, in principle, is to give a gentle introduction to this field and promote Information Security awareness. However, the technicalities of IP-Sec, Crypto, IDS, etc. will not be suitable for my audience.

So, my questions:

What topics should be taught in this course? I need 14 modules (1 module a week, with 3 lectures (of 1 hour each) per module).

How to teach technical topics of security to non-CS students? Or maybe not teach them at all and just breeze through the terminology?

pnp
  • 1,818
  • 2
  • 26
  • 42
  • 1
    So you're looking to create a 42 lectures (assuming hour long) about information security to teach at a university? I think you may want to first look at what the goal of the course is intended to be, then work your way back from there in terms of determining what core topics to cover. My main focus would be security literacy, giving the students the tools they need to be able to look at something and gauge it's security footing and risks. One method that might engage your students could be to focus on case studies of security incidents, then explore what could be done to protect/prevent. – Daisetsu Oct 09 '18 at 01:20
  • 2
    There's also a Computer Science stack exchange meant for students and researchers, they probably could give you a lot of pointers as to what current students like/dislike about their courses. – Daisetsu Oct 09 '18 at 01:22
  • @Daisetsu Yes, 42 hours content is what I want to create. I guess the broad goal is somewhat straightforward here, which you have rightly mentioned as security literacy. Why don't you expand your points in the form of an aswer? Maybe point to some specific case studies and how to teach the concepts using them? – pnp Oct 10 '18 at 05:16
  • 1
    Your learning objectives are not well-defined, so it will be difficult to come up with answers. – schroeder Oct 10 '18 at 09:59

2 Answers2

1

Breezing through the terminology won't help, it might be difficult for them to recall all the terms and they might not truly understand the importance without seeing practical examples. And if it is the first time it will be done, I suspect it should go well, with good review and grades. If they're not CS students, I would say you need to keep it simple. I would go with basics such as:

  • email security - spamming, phishing, scams;
  • physical security - dumpster diving, tailgating;
  • social engineering and how it can be used;
  • passwords/ passphrases and only high level hashing maybe;
  • OWASP, STRIDE, CIA triad, AAA (triple a);
  • browser security - such as how can they know if something they download is secure or not, certificates - not technical details, but basics so they can know if a site is secure, http vs https;
  • digital signing and encryption (not in depth, maybe its importance and something like caesar cipher they can play with so it will be fun for them, not complex stuff) and so on.

But for each of these topics, I wouldn't stick with the terminology, I would try to show them examples using images/ demos.

If it makes sense, let me know and maybe I can provide help or online resources where you can look for these kinds of topics.

There is a security certification meant to cover the basics, it's called CompTIA Security+. Of course, you don't have to take the certification. But if you look for its requirements, you will find a list of topics that might be of interest for you. It has a wide range of modules, from absolutely zero knowledge to basics for CS people. You don't have to cover the ones that seem more technical, for your purpose. The resources to learn for this certification for sure contain what you need. The best resources I can recommend you are the following:

  • Dariil Gibson's book - Get Certified Get Ahead,
  • Professor Messer videos (this one is free),
  • Pluralsight website - CompTIA Security+ the 501 Path (if your University provided you access to Pluralsight; or if you have Microsoft Student Partner organization at the University they might be able to provide you free access, though I cannot guarantee).

You don't have to cover all of them. I found the videos more easy going, and the Pluralsight ones more structured and concise. If you prefer to read a book, that one should be helpful.

schroeder
  • 123,438
  • 55
  • 284
  • 319
rtsec
  • 95
  • 4
  • I have edited the answer and you can find there more details. Those resources contain other useful topics that I forgot to mention, such as malware, antivirus sw, biometrics and so on. The book may provide you a full list of possible topics in the objectives section, the introduction chapter. – rtsec Oct 10 '18 at 09:28
1

If your learning objectives are "intro to infosec" and "security awareness", then break down those topics into their component parts.

"Security awareness" is a combination of "threat awareness" and "digital proficiency" (how to safely use tools).

"Intro to infosec" might cover career areas around organized defensive approaches and research/testing.

You apply these topics to the practical areas that affect the average student:

  • mobile
    • threats
    • digital proficiency
    • organized defense/protection
    • areas of research
  • web
    • threats
    • digital proficiency
    • organized defense/protection
    • areas of research
  • corporate/school networks including desktops/laptops
    • threats
    • digital proficiency
    • organized defense/protection
    • areas of research

Then you add in some cover of core concepts: CIA, AAA, OSI (I'm a fan of teaching technology stacks to new users), backups, encryption, risk.

That's 12 modules (4 topic areas x 3 practical areas), plus 2 modules to cover the core concepts.

schroeder
  • 123,438
  • 55
  • 284
  • 319