1. Developing Course Modules on Cybersecurity Software and Product Development
Xiaohong (Dorothy) Yuan
North Carolina A&T State University
11/16/2017
Cybersecurity Education Workshop at New Orleans

2. Developing course modules in 3 areas:
Cybersecurity Fundamentals
Secure Software Development
Cybersecurity Product Development

3. Course Modules on Cybersecurity Fundamentals
Module I: Authentication
Module II: Authorization
Module III: Intrusion Detection

4. Course Modules on Secure Software Development
Module 1: Software Vulnerability
Module 2: Secure Software Development Lifecycle
Module 3: Software Risk Management
Module 4: Security Requirements
Module 5: Secure Coding
Module 6: Security Testing

5. Course Modules on Cybersecurity Product Development
Module 1: Users and Cognitive Models
Module 2: Field Studies of Security or Privacy Technology
Module 3: Usability Evaluation of New or Existing Security or Privacy Features

6. Security Requirements Module: Learning Outcomes
Remember and Understand (Match): The different security requirements and the description of them.
Remember and Understand (Define): What is an abuse case?
Evaluate and Synthesize (Create): Create abuse cases based on CAPEC attack patterns.
Apply and Analyze (Analyze): Considering an attack scenario of an application, what are the security requirements the application should have to prevent the attack from succeeding?
Apply and Analyze (Apply): Considering an attack scenario of an application, what are some mitigation strategies to prevent the attack from succeeding?

7. Content Lecture (Power Point Slides)
Quizzes (multiple choice questions)
Project (or hands-on lab)
Cases for Discussion
Sample Solution for Case Discussion Questions

8. Lecture Content Security Requirements Security Goals
Different Security Requirements
Importance of Security Requirements
Abuse Cases
Abuse Case Development

9. Project
Provide a method for developing abuse cases based on use cases and CAPEC attack patterns
Provide a requirements specification for a web application
Students will develop abuse cases for the given application

10. Cases for Discussion
Provide description of 6 short cases of attacks on applications
Students will disucss:
What are the security requirements the application should have to prevent the attack from succeeding?
What are some mitigation strategies to prevent the attack from succeeding?

11. Module Details: Interconnections
Lessons
Presentations
Activity/Lab Title and Number of Exercises
Advanced Challenges
Security Requirements X
“Attack Scenarios”
1 exercise
N/A
Abuse Case
“Abuse Cases Development”

12. Module Details: Files and Resources
Instructional Files and Online Resources that are Needed:
Lesson 1: Security Requirements Basics
SecReq_Lesson1_ Basics_Presentation.pptx
SecReq_Lesson1_Basics_Activity.docx
SecReq_Lesson1_Basics_ActivityFiles
Lesson 2: Abuse Cases
SecReq_Lesson2_ AbuseCase_Presentation.pptx
SeS_Lesson2_AbuseCase_Lab.docx
SecReq_Lesson2_AbuseCase_LabFiles

13. Module Details: Assessment1 2 3 4 5 6 7 8 9 10 11 12
1.1 X
1.2
1.3
2.1
2.2