<p>An important and fairly contained topic is to introduce the impact of technology changing. As software designers, we will make assumptions which have a critical impact on security. Bunnie interposed a break-out connector on his Xbox ROM, and now we have <a href="http://adamsblog.aperturelabs.com/2013/01/fun-with-masked-roms.html" rel="nofollow noreferrer">OpenCV</a> to read ROMs directly. Assumptions about how much crypto $100 of compute will buy you change (sometimes in big steps - 10 years ago, you couldn't buy fast cycles without buying the hardware yourself). BGA reflow used to be an expert operation (with X-ray analysis), now people go it in their toaster...</p>

<p>These changes over time mean that the attack surface will also tend to expand - complex indirect hacks can become trivial.</p>

<p>The impact of this is that any secuity system which can't be updated will become insecure - fairly certainly.</p>

CC BY-SA 3.0
2017-07-31T09:19:49.240Z
2017-07-31T09:19:49.240Z
Sean Houlihane
<p>The course that I offered was all about gdb, hexdumps, buffer overflows, and format string vulnerabilities.  As a textbook, we used <a href="https://www.barnesandnoble.com/p/hacking-jon-erickson/1100353326/2673794901631?st=PLA&amp;sid=BNB_DRS_Marketplace+Shopping+Textbooks_00000000&amp;2sid=Google_&amp;sourceId=PLGoP20420&amp;k_clickid=3x20420" rel="noreferrer">Hacking</a>, by Jon Erickson.
 AP CS A was a prerequisite of the course, though I permitted students to join the class if they were currently enrolled in that course, as long as we had a discussion outlining expectations first.  There were no mathematical prerequisites.</p>

<p>The course was designed with the assistance of a Navy officer. The students practiced fuzzing and hacking (admittedly insecure) programs on old, virtual systems.  This was quite deliberate!  I didn't start by asking, <em>"what will the kids be able to gain entry into at the end?"</em>  Instead, I posed this question to the officer: <em>"High school students are also quite young, so there is little pressure to give them useful skills right now. CTF competitions abound, and my students are already joining those. What is hard to pick up from CTFs, but nevertheless is ultimately quite central? What can we offer them that will help them develop into top minds in this field in the future?"</em>  And that became the central mantra of the course.</p>

<p>Everything was done by hand at a *nix prompt, and they got a fair amount of practice reading and examining hexdumps.  By the end, they could look at a hexdump and see at a glance where, for instance, the text strings were stored.</p>

<p>It was ultimately a computer science course on binary and hexadecimal, on system variables, and on the intricate operations of a runtime stack.  As an additional bonus, they all got pretty adept at navigating a bash prompt.  The students kept asking for network hacking as well, though we didn't have time to get that far.  </p>

<p>The material was quite dense and unintuitive.  (Though, I suppose, if these practices were intuitive, they wouldn't have been vulnerabilities in the first place.)  It was an extremely difficult class, although the material itself kept the kids pretty interested, so you will have that working in your favor if you go down this road.</p>

CC BY-SA 3.0
2017-07-30T23:28:36.283Z
2017-07-30T23:34:52.823Z
2017-07-30T23:34:52.823Z
Ben I.
<p>I have taught various levels of Information Security, from basic security at schools and university to "extreme hacking" for experienced professionals at global security consultancies. Currently I'm the Research Director for ISACA Scotland, with a remit to work with Education to build syllabi and training for the next generation of security practitioners, and I have a fairly broad view on what should be incorporated here. It does make for multiple books, but as headline topics, I'd suggest:</p>

<ul>
<li>networking</li>
<li>system architecture (Windows, Unix, others)</li>
<li>a variety of languages (assembler, Object Oriented, classic languages such as COBOL, Forth, java etc)</li>
<li>Security concepts (safes, locks, alarms etc) and their relationship to cyber concepts (firewalls, IDS etc)</li>
<li>entry level Crypto</li>
<li>capture the flag</li>
<li>red and blue teaming</li>
<li>social engineering</li>
<li>containers, virtualisation, cloud and everything-as-a-service</li>
<li>logs and logging</li>
<li>forensics</li>
</ul>

<p>But there is so much more you could add in... Probably worth getting the syllabus from various universities and schools with security faculties, and build from them.</p>

<p>And more importantly, visit <a href="http://Https://security.stackexchange.com" rel="noreferrer">Security Stack Exchange</a> where security queries can be tackled by heaps of skilled and experienced security practitioners.</p>

CC BY-SA 3.0
2017-08-01T14:25:07.267Z
An interesting answer. Welcome to [cseducators.se]!
ItamarG3
CC BY-SA 3.0
2017-08-01T14:25:52.097Z
Thanks - as a disclaimer, I'm one of the Security Stack Exchange mods :-)
Rory Alsop
CC BY-SA 3.0
2017-08-01T14:26:20.697Z
Oh, I know ;) (I looked around other sites a while back :D)
ItamarG3
CC BY-SA 3.0
2017-08-01T14:35:00.103Z
Lol. I wasn't aware of this site until now, so I'll stick around and see if I can help. I'm a bit niche though - never taught broader comp sci, just sec.
Rory Alsop
CC BY-SA 3.0
2017-08-01T14:35:50.397Z
Why not come by out [chat](https://chat.stackexchange.com/rooms/59174/the-classroom)
ItamarG3
CC BY-SA 3.0
2017-08-01T14:40:20.123Z
That's a lot for one semester (or one year)! Also, welcome to the site! These might be up your alley: https://cseducators.stackexchange.com/questions/1079/how-do-i-teach-ethics-in-hacking https://cseducators.stackexchange.com/questions/79/how-to-raise-students-security-awareness-in-programming https://cseducators.stackexchange.com/questions/1143/demonstrating-the-possible-dangers-of-sql-injection https://cseducators.stackexchange.com/questions/1327/classroom-use-of-a-limited-port-scan-in-the-wild
Ben I.
CC BY-SA 3.0
2017-08-01T14:18:50.093Z
2017-08-01T14:18:50.093Z
Rory Alsop
<p>When someone says we should teach "cyber security" what does that mean to you? Is it computer science or system management or some mix of the two? What would you include in a course on cyber security that would make it a real computer science course?</p>

CC BY-SA 3.0
2017-07-30T23:21:56.807Z
It would be good if you could say a bit more about your expectations for the course and the backgrounds students would have, both in math and computing. Are you looking for just an overview of the field, or for the students to  have some level of technical or operational knowledge at the end?
Buffy
CC BY-SA 3.0
2017-07-30T23:35:13.443Z
I've downvoted this question because it sounds too broad for a single answer to cover. You could write a book on teaching cybersecurity. You might be able to narrow this question by elaborating on what you mean by "real computer science".
thesecretmaster
CC BY-SA 3.0
2017-07-31T13:22:08.580Z
I'm really looking for what others think is "real computer science" and "Cybersecurity." It was deliberately written broadly because I didn't want narrow answers.
Alfred Thompson
CC BY-SA 3.0
2017-08-01T14:21:01.403Z
As nobody really agrees what cyber security is, I think you will not get simple answers that will fulfil your requirement.
Rory Alsop
<security>
What should be in a CyberSecurity Course in secondary school?
# What should be in a CyberSecurity Course in secondary school?

(Asked by: username_0 on 2017-07-30)

When someone says we should teach "cyber security" what does that mean to you? Is it computer science or system management or some mix of the two? What would you include in a course on cyber security that would make it a real computer science course?

**Tags:** security

> **Comments:**
> **username_1**: It would be good if you could say a bit more about your expectations for the course and the backgrounds students would have, both in math and computing. Are you looking for just an overview of the field, or for the students to  have some level of technical or operational knowledge at the end?  
> **username_2**: I've downvoted this question because it sounds too broad for a single answer to cover. You could write a book on teaching cybersecurity. You might be able to narrow this question by elaborating on what you mean by "real computer science".  
> **username_0**: I'm really looking for what others think is "real computer science" and "Cybersecurity." It was deliberately written broadly because I didn't want narrow answers.  
> **username_3**: As nobody really agrees what cyber security is, I think you will not get simple answers that will fulfil your requirement.  

---

## 3 answers

### Answer by username_5 on 2017-07-30. Score: 5

The course that I offered was all about gdb, hexdumps, buffer overflows, and format string vulnerabilities. As a textbook, we used [Hacking](https://www.barnesandnoble.com/p/hacking-jon-erickson/1100353326/2673794901631?st=PLA&sid=BNB_DRS_Marketplace+Shopping+Textbooks_00000000&2sid=Google_&sourceId=PLGoP20420&k_clickid=3x20420), by Jon Erickson.
AP CS A was a prerequisite of the course, though I permitted students to join the class if they were currently enrolled in that course, as long as we had a discussion outlining expectations first. There were no mathematical prerequisites.

The course was designed with the assistance of a Navy officer. The students practiced fuzzing and hacking (admittedly insecure) programs on old, virtual systems. This was quite deliberate! I didn't start by asking, *"what will the kids be able to gain entry into at the end?"* Instead, I posed this question to the officer: *"High school students are also quite young, so there is little pressure to give them useful skills right now. CTF competitions abound, and my students are already joining those. What is hard to pick up from CTFs, but nevertheless is ultimately quite central? What can we offer them that will help them develop into top minds in this field in the future?"* And that became the central mantra of the course.

Everything was done by hand at a \*nix prompt, and they got a fair amount of practice reading and examining hexdumps. By the end, they could look at a hexdump and see at a glance where, for instance, the text strings were stored.

It was ultimately a computer science course on binary and hexadecimal, on system variables, and on the intricate operations of a runtime stack. As an additional bonus, they all got pretty adept at navigating a bash prompt. The students kept asking for network hacking as well, though we didn't have time to get that far.

The material was quite dense and unintuitive. (Though, I suppose, if these practices were intuitive, they wouldn't have been vulnerabilities in the first place.) It was an extremely difficult class, although the material itself kept the kids pretty interested, so you will have that working in your favor if you go down this road.


---

### Answer by username_3 on 2017-08-01. Score: 5

I have taught various levels of Information Security, from basic security at schools and university to "extreme hacking" for experienced professionals at global security consultancies. Currently I'm the Research Director for ISACA Scotland, with a remit to work with Education to build syllabi and training for the next generation of security practitioners, and I have a fairly broad view on what should be incorporated here. It does make for multiple books, but as headline topics, I'd suggest:

* networking
* system architecture (Windows, Unix, others)
* a variety of languages (assembler, Object Oriented, classic languages such as COBOL, Forth, java etc)
* Security concepts (safes, locks, alarms etc) and their relationship to cyber concepts (firewalls, IDS etc)
* entry level Crypto
* capture the flag
* red and blue teaming
* social engineering
* containers, virtualisation, cloud and everything-as-a-service
* logs and logging
* forensics

But there is so much more you could add in... Probably worth getting the syllabus from various universities and schools with security faculties, and build from them.

And more importantly, visit [Security Stack Exchange](http://Https://security.stackexchange.com) where security queries can be tackled by heaps of skilled and experienced security practitioners.

> **Comments:**
> **username_6**: An interesting answer. Welcome to [cseducators.se]!  
> **username_3**: Thanks - as a disclaimer, I'm one of the Security Stack Exchange mods :-)  
> **username_6**: Oh, I know ;) (I looked around other sites a while back :D)  
> **username_3**: Lol. I wasn't aware of this site until now, so I'll stick around and see if I can help. I'm a bit niche though - never taught broader comp sci, just sec.  
> **username_6**: Why not come by out [chat](https://chat.stackexchange.com/rooms/59174/the-classroom)  
> **username_5**: That's a lot for one semester (or one year)! Also, welcome to the site! These might be up your alley: https://cseducators.stackexchange.com/questions/1079/how-do-i-teach-ethics-in-hacking https://cseducators.stackexchange.com/questions/79/how-to-raise-students-security-awareness-in-programming https://cseducators.stackexchange.com/questions/1143/demonstrating-the-possible-dangers-of-sql-injection https://cseducators.stackexchange.com/questions/1327/classroom-use-of-a-limited-port-scan-in-the-wild  

---

### Answer by username_4 on 2017-07-31. Score: 1

An important and fairly contained topic is to introduce the impact of technology changing. As software designers, we will make assumptions which have a critical impact on security. Bunnie interposed a break-out connector on his Xbox ROM, and now we have [OpenCV](http://adamsblog.aperturelabs.com/2013/01/fun-with-masked-roms.html) to read ROMs directly. Assumptions about how much crypto $100 of compute will buy you change (sometimes in big steps - 10 years ago, you couldn't buy fast cycles without buying the hardware yourself). BGA reflow used to be an expert operation (with X-ray analysis), now people go it in their toaster...

These changes over time mean that the attack surface will also tend to expand - complex indirect hacks can become trivial.

The impact of this is that any secuity system which can't be updated will become insecure - fairly certainly.


---

