I deliberated whether I should publish this question here, or in CS.stackexchange. I decided to do it here, as I think that the opinion of security experts will be more helpful.
I'm teaching in some academic institute. We decided to add a mandatory course: Introduction to Cyber Security.
We know that most of our graduates won't stay in the academy and go to work, and we believe that at least basic knowledge in information security is a must today. The course's goal is not to make the students professional information security people, but to give them the basic and expose them to this field.
Generally, I can count two goals of this course:
Expose the students to the world of information security, and give them (again, most of them will go to the industry) useful tools and knowledge. The tools and the knowledge should be useful also for graduates who do not work in the field of information security.
Encourage students to take also the advanced courses in this field.
Considering these goals, I have two questions for you, as we now have discussions about the content of the course.
Which subjects you believe should be included in such a course? What are the most important things? Which topics are the most relevant for graduates that will work in the industry, but not in the field of information security. Specifically, topics like Secure Coding are very relevant to every programmer, but it is less interesting (in my opinion). Another topic that I thought about, is passwords management.
We have special debate about SSL. I believe it is a must in such a course. Even if we choose not to teach about the specific algorithms, it is a must to know how this protocol works: What is certificate, how to use it, which problems SSL comes to solve, etc. Everyone uses this protocol, and I encountered many cases where knowledge of SSL was crucial. However, I was surprised to see that I have some opposition about this topic (SSL). I would like to hear your opinion: do you think SSL should be one of the topics?
Every other ideas and remarks are welcomed.
Thanks in advance,
My course contains 13 meetings (units) of three (academic) hours each. Units that I believe should be in the course, some of them following your great answers:
Introduction + CIA triad
Thinking like a hacker
Scans (and relevant tools).
Firewall, IDS, IPS
Public and Private key shortly and SSL
Denial of Service
Network level - mainly DNS
Application level - two units with basic examples: SQL injection and maybe XSS (as second attack).
Secure-Coding - with attention to mobile (and common mistakes).
What do you say? I mentioned 12 topics.