A Curricular Strategy for Information Security Engineering

Existing textbooks and training materials in basic information security do not reflect the actual problem solving techniques and practices in the field of information security engineering. In general, texts focus on memorization of a broad range of facts related to modern information security practice. Analytical techniques, when present, often focus on mathematical foundations of cryptography, the inner workings of security protocols, and perhaps the logical derivation of formal security policy statements. In practice, information security engineering involves a life cycle starting with requirement analysis, progressing through design analysis and deployment, and repeating the cycle following a period of system monitoring and incident response. A fundamental activity in the practice of information security engineering is the assessment of security perimeters that divide a system into more-trustworthy and less-trustworthy components. This type of analysis is applied at every level of an information security system to yield an overall assessment of its security. Perimeter assessment requires that a student learn fundamental features of computer systems at the hardware, operating system, application, and network level. This yields a coherent curricular strategy that incorporates certain classical elements of cryptographic analysis (e.g. assessment of key strength), engineering requirements analysis, and fundamental elements of computer engineering