• ES Español
• EN English

2.14. Security (SEC)

Computing supports nearly every facet of modern critical infrastructure: transportation, communication, healthcare, education, energy generation and distribution, to name a few. With rampant attacks on and breaches of this infrastructure, computer science graduates have an important role in designing, implementing, and operating software systems that are robust, safe, and secure.

The Security (SEC) knowledge area focuses on developing a *security mindset* into the overall ethos of computer science graduates so that security is embedded in all their work products. Computer science students need to learn about system vulnerabilities and understand threats against computer systems. The *Security* title choice was intentional to serve as a one-word umbrella term for this knowledge area, which also includes concepts to support privacy, cryptography, secure systems, secure data, and secure code.

The SEC knowledge area relies on shared concepts pervasive in all the other areas of CS2023. It identifies seven crosscutting concepts of cybersecurity: *confidentiality*, *integrity*, *availability*, *risk assessment*, *systems thinking*, *adversarial thinking*, and *human-centered thinking*. The seventh concept, *human-centered thinking*, is additional to the six crosscutting concepts originally defined in the Cybersecurity Curricula 2017 (CSEC2017). This addition reinforces to students that humans are also a link in the overall chain of security. Principles of protecting systems include security-by-design, privacy-by-design, defense-in-depth, and zero-trust.

Another concept is the notion of assurance, which is an attestation that security mechanisms need to comply with the security policies that have been defined for data, processes, and systems. Assurance is tied in with the concepts of verification and validation. Considerations of data privacy and security are shared with the DM (technical aspects) and SEP knowledge areas.

The SEC knowledge area thus sits atop several of the other CS2023 knowledge areas, while including additional concepts that are not present in those knowledge areas. CS2023 treats security as a crucial component of the skillset of any CS graduate, and the hours needed for security preparation come from all the other 16 CS2023 knowledge areas.

Knowledge Area (KA)	CS Core	KA Core
2.14.1 Security Mindset and Principles	1	3
2.14.2 Access Control and Applications	1	3
2.14.3 AI and Hardware Security	1	2
2.14.4 Security Ethics, Law and Society	1	2
2.14.5 Privacy and Security by Design	1	1
2.14.6 Injection and Input Validation	1	2
2.14.7 Memory Safety and Types	1	1
2.14.8 Information Flow and Non-Interference	1	1
2.14.9 Malware Analysis and Advanced Security	1	3
2.14.10 Cryptography Fundamentals	1	2
2.14.11 Cryptographic Algorithms	1	2
2.14.12 Protocols, Applications and Advanced Cryptography	1	2
2.14.13 Threat Analysis and Security Engineering	1	4
2.14.14 Security Design and Controls Engineering	1	3
2.14.15 Trusted Computing and Privacy Engineering	1	3
2.14.16 Digital Forensics Techniques		4
2.14.17 Legal Aspects and Incident Handling		3
2.14.18 Security Governance, Management and Policy		2
2.14.19 Risk and Data Management		1

2.14.1. SEC/Security Mindset and Principles  (CS Core: 1 hr, KA Core: 3 hrs) ↑ Back to top

This knowledge unit introduces fundamental security concepts, crosscutting principles, and the development of a security mindset. It covers confidentiality, integrity, availability, risk assessment, systems thinking, adversarial thinking, and human-centered thinking. It also includes basic authentication, authorization, vulnerabilities, threats, attack surfaces, denial of service, protection principles, and the impact of AI on security and privacy.
Topics:
Core

• Developing a security mindset incorporating crosscutting concepts: confidentiality, integrity, availability, risk assessment, systems thinking, adversarial thinking, human-centered thinking.
• Vulnerabilities, threats, attack surfaces, and attack vectors Protection and Safety .
• Denial of Service (DoS) and Distributed Denial of Service (DDoS) Protection and Safety .
• Principles and practices of protection, e.g., least privilege, open design, fail-safe defaults, defense in depth, and zero trust; and how they can be implemented Principles of Operating System , Protection and Safety , Coding Practices , Large-Scale Construction and Process , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
• Optimization considerations between security, privacy, performance, and other design goals System Design , Software Development Practices , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
• Concepts of trust and trustworthiness.

Learning Outcomes:
Core:

1. Evaluate a system for possible attacks that can be launched by an adversary [Evaluate]
2. Design and develop approaches to protect a system from a set of identified threats [Design]
3. Describe how harm to user privacy can be avoided [Describe]
4. Develop a system that incorporates various principles of security and privacy [Create]

2.14.2. SEC/Access Control and Applications  (CS Core: 1 hr, KA Core: 3 hrs) ↑ Back to top

Topics:
Core

• Basic concepts of authentication and authorization/access control.
• Access control models (e.g., discretionary, mandatory, role-based, and attribute-based).
• Security controls.
• Applications of a security mindset: web, cloud, and mobile devices System Design , Common Aspects: Platforms, APIs and Constraints , Common Aspects: Platform Languages and Web Programming Patterns .
• Protecting embedded and cyber-physical systems Embedded Characteristics and Architectures , Real-Time, Memory and Verification , Systems, Programming and Sensors .
• Principles of usable security and human-centered computing System Design , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .

Learning Outcomes:
Core:

1. Compare the different access control models in terms of functionality and performance [Compare]

2.14.3. SEC/AI and Hardware Security  (CS Core: 1 hr, KA Core: 2 hrs) ↑ Back to top

Topics:
Core

• Impact of AI on security and privacy: using AI to bolster defenses as well as address increased adversarial capabilities due to AI AI Applications and Societal Impact , Additional AI Applications and Societal Impact , Society, Ethics, and the Profession , System Design .
• Security and trust in AI/machine learning systems, e.g., fit for purpose, ethical operating boundaries, authoritative knowledge sources, verified training data, repeatable system evaluation tests, system attestation, independent validation/certification; unintended consequences from: adverse effect AI Applications and Societal Impact , Additional AI Applications and Societal Impact , Machine Learning Formulation and Evaluation , Deep Learning, RL and Ethics , Introduction to AI: Concepts and Intelligent Behavior , Problem Characteristics and Agent Nature , Machine Learning Fundamentals , Machine Learning Data, Representations and Evaluation , Neural Networks and Ethics , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
• Security risks in building and operating AI/machine learning systems (e.g., algorithm bias, knowledge corpus bias, training corpus bias, copyright violation) AI Applications and Societal Impact , Additional AI Applications and Societal Impact , Machine Learning Formulation and Evaluation , Deep Learning, RL and Ethics , Introduction to AI: Concepts and Intelligent Behavior , Problem Characteristics and Agent Nature , Machine Learning Fundamentals , Machine Learning Data, Representations and Evaluation , Neural Networks and Ethics .
• Hardware considerations in security, e.g., principles of secure hardware, secure processor architectures, cryptographic acceleration, compartmentalization, software-hardware interaction Assembly Level Machine Organization , Machine-Level Data Representation , Role and Purpose of Operating Systems .

Learning Outcomes:
Core:

1. Show how an adversary could use machine learning algorithms to reduce the security of a system [Analyze]
2. Show how a developer could improve the security of a system using machine learning algorithms [Analyze]
3. Describe hardware (especially CPU) vulnerabilities that can impact software [Describe]

2.14.4. SEC/Security Ethics, Law and Society  (CS Core: 1 hr, KA Core: 2 hrs) ↑ Back to top

This unit covers societal, ethical, legal, and professional aspects of security and privacy, including security-by-design, privacy-by-design, ethical hacking, and the implications of emerging technologies.
Topics:
Core

• Societal impacts on breakdowns in security and privacy Digital Equity and Accessibility , Social Impact and AI , Civil Liberties and Expression , Data, Surveillance and Privacy Technology , Privacy Philosophical Foundations and Legislation , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
• Applicability of laws and regulations on security and privacy Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
• Professional ethical considerations when designing secure systems and maintaining privacy; ethical hacking Civil Liberties and Expression , Data, Surveillance and Privacy Technology , Privacy Philosophical Foundations and Legislation , Ethics Codes and Legal Accountability , Professional Responsibility and Public Policy , Professional Values, Nature and Continuing Development , Ethical Dissent and Cultural Context , Workplace Ethics , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
• Security and privacy implications of malicious AI/machine learning actors, e.g., identifying deep fakes Machine Learning Formulation and Evaluation , Deep Learning, RL and Ethics , Introduction to AI: Concepts and Intelligent Behavior , Problem Characteristics and Agent Nature , Machine Learning Fundamentals , Machine Learning Data, Representations and Evaluation , Neural Networks and Ethics , Civil Liberties and Expression , Data, Surveillance and Privacy Technology , Privacy Philosophical Foundations and Legislation , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
• Societal impacts of Internet of Things (IoT) devices and other emerging technologies on security and privacy Civil Liberties and Expression , Data, Surveillance and Privacy Technology , Privacy Philosophical Foundations and Legislation , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .

Learning Outcomes:
Core:

1. Calculate the impact of a breakdown in security of a given system [Calculate]
2. Construct a system that conforms to security laws [Create]
3. Apply a set of privacy regulations to design a system that protects privacy [Apply]
4. Evaluate the legal ramifications of a system not corresponding to applicable laws and regulations [Evaluate]

2.14.5. SEC/Privacy and Security by Design  (CS Core: 1 hr, KA Core: 1 hr) ↑ Back to top

Topics:
Core

• Principles and practices of privacy Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
• Security by design System Design , System Security .
• Privacy by design and privacy engineering Civil Liberties and Expression , Data, Surveillance and Privacy Technology , Privacy Philosophical Foundations and Legislation , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .

Learning Outcomes:
Core:

1. Construct a system that is designed to avoid harm to user privacy [Create]

2.14.6. SEC/Injection and Input Validation  (CS Core: 1 hr, KA Core: 2 hrs) ↑ Back to top

This unit covers common software vulnerabilities, secure coding practices, defensive programming, and tools for static and dynamic analysis to prevent and mitigate security flaws.
Topics:
Core

• Common vulnerabilities and weaknesses.
• SQL injection and other injection attacks.
• Cross-site scripting techniques and mitigations.
• Input validation and data sanitization Protection and Safety , Basic Programming Concepts and Constructs , Programming Practices: Testing, Debugging, and Documentation , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .

Learning Outcomes:
Core:

1. Identify underlying problems in given examples of an enumeration of common weaknesses and explain how they can be circumvented [Analyze]
2. Apply input validation and data sanitization techniques to enhance security of a program [Apply]
3. Evaluate and prevent SQL injections attacks on a database application [Evaluate]
4. Evaluate and prevent cross-site scripting attacks against a website [Evaluate]
5. Construct a program that tests for all input handling errors [Create]

2.14.7. SEC/Memory Safety and Types  (CS Core: 1 hr, KA Core: 1 hr) ↑ Back to top

Topics:
Core

• Type safety and type-safe languages Advanced Type Theory , Systems Execution and Memory Model , Type Systems Fundamentals , Type Systems: Polymorphism and Complementary Typing , Protection and Safety , Basic Programming Concepts and Constructs , Programming Practices: Testing, Debugging, and Documentation , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
• Buffer overflows, stack smashing, and integer overflows Assembly Level Machine Organization , Systems Execution and Memory Model , Protection and Safety .
• Security issues due to race conditions Parallel and Distributed Computing , Evaluation .

Learning Outcomes:
Core:

1. Describe how the selection of a programming language can impact the security of the system being constructed [Describe]
2. Rewrite a program in a type-safe language (e.g., Java or Rust) originally written in an unsafe programming language (e.g., C/C++) [Redesign]
3. Evaluate a program for possible buffer overflow attacks and rewrite to prevent such attacks [Evaluate]
4. Evaluate a set of related programs for possible race conditions and prevent an adversary from exploiting them [Evaluate]

2.14.8. SEC/Information Flow and Non-Interference  (CS Core: 1 hr, KA Core: 1 hr) ↑ Back to top

Topics:
Core

• Principles of noninterference and nondeducibility.
• Preventing information flow attacks.

Learning Outcomes:
Core:

1. Construct a system that is protected from unauthorized information flows [Create]

2.14.9. SEC/Malware Analysis and Advanced Security  (CS Core: 1 hr, KA Core: 3 hrs) ↑ Back to top

Topics:
Core

• Offensive security techniques as a defense.
• AI-assisted malware detection techniques.
• Ransomware: creation, prevention, and mitigation.
• Secure use of third-party components Coding Practices , Large-Scale Construction and Process , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
• Malware: varieties, creation, reverse engineering, and defense against them Language Translation and Execution , Systems Execution and Memory Model .
• Assurance: testing (including fuzzing and penetration testing), verification, and validation Protection and Safety , Basic Programming Concepts and Constructs , Programming Practices: Testing, Debugging, and Documentation , Coding Practices , Large-Scale Construction and Process , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
• Static and dynamic analyses Program Analysis and Analyzers , Protection and Safety , Evaluation , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
• Secure compilers and secure code generation Language Translation and Execution , Run-time Behavior and Systems .

Learning Outcomes:
Core:

1. Describe different kinds of malicious software [Describe]
2. Explain the risks of misusing interfaces with third-party code and how to correctly use third-party code [Explain]
3. Discuss the need to update software to fix security vulnerabilities and the lifecycle management of the fix [Debate]
4. Apply static and dynamic tools to identify programming faults [Apply]
5. Evaluate a system for the existence of malware and remove it [Evaluate]
6. Implement preventive techniques to reduce the occurrence of ransomware [Implement]

2.14.10. SEC/Cryptography Fundamentals  (CS Core: 1 hr, KA Core: 2 hrs) ↑ Back to top

This unit introduces cryptographic principles, algorithms, protocols, and their applications in securing data and communications, including symmetric/asymmetric encryption, hashing, digital signatures, and emerging topics like quantum and post-quantum cryptography.
Topics:
Core

• Differences between algorithmic, applied, and mathematical views of cryptography.
• Mathematical preliminaries: modular arithmetic, Euclidean algorithm, probabilistic independence, linear algebra basics, number theory, finite fields, complexity, asymptotic analysis Discrete Mathematics , Linear Algebra .
• Basic cryptography: symmetric key and public key cryptography Foundational Data Structures , Foundational Algorithms , Advanced Algorithms , Discrete Mathematics .
• Classical cryptosystems, such as shift, substitution, transposition ciphers, code books, and machines Discrete Mathematics .
• Kerckhoff's principle and use of vetted libraries Coding Practices , Large-Scale Construction and Process .

Learning Outcomes:
Core:

1. Explain the role of cryptography in supporting security and privacy [Explain]
2. Discuss the risks of inventing one's own cryptographic methods [Debate]
3. Discuss the importance of prime numbers in cryptography and explain their use in cryptographic algorithms [Debate]
4. Implement and cryptanalyze classical ciphers [Implement]

2.14.11. SEC/Cryptographic Algorithms  (CS Core: 1 hr, KA Core: 2 hrs) ↑ Back to top

Topics:
Core

• Basic cryptographic building blocks, including symmetric encryption, asymmetric encryption, hashing, and message authentication Discrete Mathematics .
• Additional mathematics: primality, factoring, and elliptic curve cryptography Discrete Mathematics .
• Private-key cryptosystems: substitution-permutation networks, linear cryptanalysis, differential cryptanalysis, DES, and AES Discrete Mathematics , Network Security .
• Public-key cryptosystems: Diffie-Hellman and RSA Discrete Mathematics .
• Data integrity and authentication: hashing, and digital signatures Data Security and Privacy , Discrete Mathematics .
• Attacker capabilities: chosen-message attack (for signatures), birthday attacks, side channel attacks, and fault injection attacks Network Security .

Learning Outcomes:
Core:

1. Describe how crypto keys can be managed securely [Describe]
2. Compare the space and time performance of a given set of cryptographic methods [Compare]
3. Discuss how modern private-key cryptosystems work and ways to cryptanalyze them [Debate]
4. Discuss how modern public-key cryptosystems work and ways to cryptanalyze them [Debate]
5. Compare different cryptographic algorithms in terms of security [Compare]
6. Explain key exchange protocols and show approaches to reduce their failure [Explain]

2.14.12. SEC/Protocols, Applications and Advanced Cryptography  (CS Core: 1 hr, KA Core: 2 hrs) ↑ Back to top

Topics:
Core

• Usage of cryptography in real-world applications, e.g., electronic cash, secure channels between clients and servers, secure electronic mail, entity authentication, device pairing, steganography, and voting systems Image Processing , Network Security .
• Cryptographic protocols: challenge-response authentication, zero-knowledge protocols, commitment, oblivious transfer, secure two- or multi-party computation, hash functions, secret sharing, and applications Discrete Mathematics .
• Quantum cryptography; Post Quantum/Quantum resistant cryptography Foundational Data Structures , Foundational Algorithms , Advanced Algorithms , Discrete Mathematics .
• Blockchain and cryptocurrencies Discrete Mathematics , Communication .

Learning Outcomes:
Core:

1. Describe real-world applications of cryptographic primitives and protocols [Describe]
2. Discuss how quantum cryptography works and the impact of quantum computing on cryptographic algorithms [Debate]

2.14.13. SEC/Threat Analysis and Security Engineering  (CS Core: 1 hr, KA Core: 4 hrs) ↑ Back to top

This unit covers systematic approaches to security engineering, including threat modeling, risk analysis, security design, attack domains, and trustworthy computing.
Topics:
Core

• Security engineering goals: building systems that remain dependable despite errors, accidents, or malicious adversaries Coding Practices , Large-Scale Construction and Process , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
• Problem analysis and situational analysis to address system security Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
• Security analysis, covering security requirements analysis; security controls analysis; threat analysis; and vulnerability analysis Program Analysis and Analyzers , Evaluation .
• Security attack domains and attack surfaces, e.g., communications and networking, hardware, physical, social engineering, software, and supply chain Network Security .
• Security attack modes, techniques, and tactics, e.g., authentication abuse; brute force; buffer manipulation; code injection; content insertion; denial of service; eavesdropping; function bypass; impersonation; integrity attack; interception; phishing; protocol analysis; privilege abuse; spoofing; and traffic injection Network Security , Protection and Safety , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .

Learning Outcomes:
Core:

1. Create a threat model for a system or system design [Create]
2. Apply situational analysis to develop secure solutions under a specified scenario [Apply]
3. Identify and mitigate security vulnerabilities and weaknesses in a system [Analyze]

2.14.14. SEC/Security Design and Controls Engineering  (CS Core: 1 hr, KA Core: 3 hrs) ↑ Back to top

Topics:
Core

• Engineering tradeoff analysis based on time, cost, risk tolerance, risk acceptance, return on investment, and so on Evaluation , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
• Security design and engineering, including functional requirements, security subsystems, information protection, security testing, security assessment, and evaluation Evaluation , Performance Testing and Benchmarking , Requirements Engineering , Requirements Evolution and Estimation , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
• Design and development of cyber-physical systems.

Learning Outcomes:
Core:

1. Evaluate a given scenario for tradeoff analysis for system performance, risk assessment, and costs [Evaluate]
2. Design a set of technical security controls, countermeasures, and information protections to meet the security requirements and security objectives for a system [Design]
3. Evaluate the effectiveness of security functions, technical controls, and componentry for a system [Evaluate]

2.14.15. SEC/Trusted Computing and Privacy Engineering  (CS Core: 1 hr, KA Core: 3 hrs) ↑ Back to top

Topics:
Core

• Privacy engineering goals: building systems that design, implement, and deploy privacy features and controls Civil Liberties and Expression , Data, Surveillance and Privacy Technology , Privacy Philosophical Foundations and Legislation .
• Attestation of software products with respect to their specification and adaptiveness Performance Testing and Benchmarking , Requirements Engineering , Requirements Evolution and Estimation , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
• Considerations for trustworthy computing, e.g., tamper resistant packaging, trusted boot, trusted kernel, hardware root of trust, software signing and verification, hardware-based cryptography, virtualization, and containers Coding Practices , Large-Scale Construction and Process , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .

Learning Outcomes:
Core:

1. Evaluate and predict emergent behavior in areas such as Data Science, AI, and Machine Learning [Evaluate]

2.14.16. SEC/Digital Forensics Techniques  (KA Core: 4 hrs) ↑ Back to top

This unit covers principles, methodologies, and tools for digital forensics, including evidence collection, analysis, incident response, and legal considerations.
Topics:
Core

• Basic principles and methodologies for digital forensics.
• System design for forensics.
• Forensics in different situations: operating systems, file systems, application forensics, web forensics, network forensics, mobile device forensics, use of database auditing Network Security .
• Attacks on forensics and preventing such attacks.

Learning Outcomes:
Core:

1. Explain what a digital investigation is and how it can be implemented Computer Crimes and Attacks , Security Laws, Policies and Responsibility [Explain]
2. Design and implement software to support forensics [Design]
3. Extract data from a hard drive to comply with the law Computer Crimes and Attacks , Security Laws, Policies and Responsibility [Extract]
4. Recover data based on a given search term from an imaged system [Analyze]
5. Reconstruct data and events from an application history, or a web artifact, or a cloud database, or a mobile device. Mobile Platforms: Capabilities and Asynchronous Computing , Mobile Platforms: Architecture and Constraints , Mobile Platforms: Development Fundamentals , Cloud Architecture and Data Management , Frontend, Frameworks and Web Standards [Apply]
6. Capture and analyze network traffic. Network Security [Analyze]
7. Develop approaches to address the challenges associated with mobile device forensics [Create]
8. Apply forensics tools to investigate security breaches [Apply]
9. Identify and mitigate anti-forensic methods [Analyze]

2.14.17. SEC/Legal Aspects and Incident Handling  (KA Core: 3 hrs) ↑ Back to top

Topics:
Core

• Incident handling processes.
• Rules of evidence - general concepts and differences between jurisdictions Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
• Legal issues: digital evidence protection and management, chains of custody, reporting, serving as an expert witness Computer Crimes and Attacks , Security Laws, Policies and Responsibility .

Learning Outcomes:
Core:

1. Describe legal requirements for using seized data and its usage. Computer Crimes and Attacks , Security Laws, Policies and Responsibility [Describe]
2. Describe and implement an end-to-end chain of custody from initial digital evidence seizure to evidence disposal. Civil Liberties and Expression , Data, Surveillance and Privacy Technology , Privacy Philosophical Foundations and Legislation , Computer Crimes and Attacks , Security Laws, Policies and Responsibility [Describe]
3. Discuss a person's professional responsibilities and liabilities when testifying as a forensics expert Ethics Codes and Legal Accountability , Professional Responsibility and Public Policy , Professional Values, Nature and Continuing Development , Ethical Dissent and Cultural Context , Workplace Ethics [Debate]

2.14.18. SEC/Security Governance, Management and Policy  (KA Core: 2 hrs) ↑ Back to top

This unit covers organizational security governance, risk management, policy development, data lifecycle management, and protection of critical assets.
Topics:
Core

• Protecting critical assets from threats.
• Security governance: organizational objectives and general risk assessment.
• Security management: achieve and maintain appropriate levels of confidentiality, integrity, availability, accountability, authenticity, and reliability Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
• Security policy: organizational policies, issue-specific policies, system-specific policies.

Learning Outcomes:
Core:

1. Describe critical assets and how they can be protected [Describe]
2. Differentiate between security governance, management, and controls, giving examples of each [Differentiate]
3. Describe a technical control and implement it to mitigate specific threats [Describe]

2.14.19. SEC/Risk and Data Management  (KA Core: 1 hr) ↑ Back to top

Topics:
Core

• Approaches to identifying and mitigating risks to computing infrastructure.
• Data lifecycle management policies: data collection, backups, and retention; cloud storage and services; breach disclosure Data Security and Privacy .

Learning Outcomes:
Core:

1. Identify and assess risk of programs and database applications causing breaches [Analyze]
2. Design and implement appropriate backup strategies conforming to a given policy [Design]
3. Discuss a breach disclosure policy based on legal requirements and implement the policy [Debate]
4. Identify the risks and benefits of outsourcing to the cloud [Analyze]