Systems and software assurance — A model Cyber Security course

In this paper we present a model Cyber Security course primarily designed to address the educational and training needs for developing secure software intensive systems. The course is designed, within a Computer Science curriculum, to satisfy the national requirements of the Information Assurance Workforce Improvement Program (per DoD8570.01-Mfrom 11.10.2015), for Tiers II and III jobs, primarily in the Systems Architecture and Engineering (IASAE) specialty areas. The course maps to the knowledge bases of two approved Certifications for IASAE, namely the Certified Security Software Lifecycle Professional (CSSLP) and the Certified Information Security Engineering Professional (ISSEP). The course content is focused on four key elements: Security Architecture Analysis with Treat Modeling, Risk Assessment based on the Cyber Security Framework (and the NIST SP 800 series of guidelines), Secure Development Life Cycle under a process improvement framework CMMI, and a standardized set of Secure Coding best practices. At the graduate level, this course also addresses the making of formal Assurance Cases for Security and Safety of Software Intensive Systems, as well as Software Failure Mode Effect Analysis (FMEA).