Developing Course Modules on Cybersecurity Software and Product Development Xiaohong (Dorothy) Yuan North Carolina A&T State University 11/16/2017 Cybersecurity Education Workshop at New Orleans

Developing course modules in 3 areas: Cybersecurity Fundamentals Secure Software Development Cybersecurity Product Development

Course Modules on Cybersecurity Fundamentals Module I: Authentication Module II: Authorization Module III: Intrusion Detection

Course Modules on Secure Software Development Module 1: Software Vulnerability Module 2: Secure Software Development Lifecycle Module 3: Software Risk Management Module 4: Security Requirements Module 5: Secure Coding Module 6: Security Testing

Course Modules on Cybersecurity Product Development Module 1: Users and Cognitive Models Module 2: Field Studies of Security or Privacy Technology Module 3: Usability Evaluation of New or Existing Security or Privacy Features

Security Requirements Module: Learning Outcomes Remember and Understand (Match): The different security requirements and the description of them. Remember and Understand (Define): What is an abuse case? Evaluate and Synthesize (Create): Create abuse cases based on CAPEC attack patterns. Apply and Analyze (Analyze): Considering an attack scenario of an application, what are the security requirements the application should have to prevent the attack from succeeding? Apply and Analyze (Apply): Considering an attack scenario of an application, what are some mitigation strategies to prevent the attack from succeeding?

Content Lecture (Power Point Slides) Quizzes (multiple choice questions) Project (or hands-on lab) Cases for Discussion Sample Solution for Case Discussion Questions

Lecture Content Security Requirements Security Goals Different Security Requirements Importance of Security Requirements Abuse Cases Abuse Case Development

Project Provide a method for developing abuse cases based on use cases and CAPEC attack patterns Provide a requirements specification for a web application Students will develop abuse cases for the given application

Cases for Discussion Provide description of 6 short cases of attacks on applications Students will disucss: What are the security requirements the application should have to prevent the attack from succeeding? What are some mitigation strategies to prevent the attack from succeeding?

Module Details: Interconnections Lessons Presentations Activity/Lab Title and Number of Exercises Advanced Challenges Security Requirements X “Attack Scenarios” 1 exercise N/A Abuse Case “Abuse Cases Development”

Module Details: Files and Resources Instructional Files and Online Resources that are Needed: Lesson 1: Security Requirements Basics SecReq_Lesson1_ Basics_Presentation.pptx SecReq_Lesson1_Basics_Activity.docx SecReq_Lesson1_Basics_ActivityFiles Lesson 2: Abuse Cases SecReq_Lesson2_ AbuseCase_Presentation.pptx SeS_Lesson2_AbuseCase_Lab.docx SecReq_Lesson2_AbuseCase_LabFiles

Module Details: Assessment   1 2 3 4 5 6 7 8 9 10 11 12 1.1 X 1.2 1.3 2.1 2.2