Software Engineering and Security: Lessons Learned Creating a New Course in Security from a Software Engineering Perspective

Security is a rising concern for organizations hiring undergraduates out of college in computing disciplines. This is reflected in the emerging prominence of cybersecurity related courses, certificates, and degree programs, and reflected in the most recent curricular standards guidelines. Perspectives on security recognize it as both a system discipline, meaning the inclusion of hardware, software, and networking components, and a cross-cutting skill across the major phases on the software engineering lifecycle (requirements, design, verification & validation, construction, and evolution and maintenance). Our conjecture is that there are many open and available resources for the first perspective (system) but few for the second perspective (software engineering). In this paper we share experiences creating a new junior-level security course in secure software engineering as a required course in an undergraduate accredited software engineering degree program. Specifically, and aligned with the latter perspective, we share the challenges we faced when seeking curricular resources, including open courseware repositories and textbooks, to jumpstart the development. We reflect on these experiences by providing a map of curricular resources to cross-cutting software engineering lifecycle phases, examining popular open (and usually federally funded) courseware repositories including the SEED project from Syracuse University and the Cybersecurity Labs and Resource Knowledge-base (CLARK) initiative, as well as ad hoc resources.