I have to say, reading the program materials, I'm not surprised.
As you say, the IT security field is very broad - and programming is only a very thin slice of it. If you love programming, and are looking for it to be the center point of your education and your work, then I'd offer the idea that what you're really looking for are courses in Software Security - and I have yet to see many (or any) cirriculums using this as a center point.
Things to think about when looking for advanced education and working in IT Security...
What do you want the education to do for you?
IT security is still such a new field that it will be a long time before anyone really knows what a "classic" IT security professional is capable of. It will be even longer until there are jobs that require an IT Security degree as a baseline. I'd bet money that over the next 10 years, the majority of IT Security professionals are NOT people who have degrees or advanced degrees in anything bearing the title "security" - the field is still too new and too diverse.
So - the goal returns to being - what do you want from the degree? An IT security degree as the programs I've seen are currently designed will help get you in touch with some of the current best practices and the business tradeoffs in the industry. But if you want to be a technical whiz at any particular discipline (programming, networking, computer OSes, management) - then consider a program in that discipline.
What IS an IT security degree?
I expect this answer to be extremely dated in the next few years, but worth the attempt...
It's currently separating itself from any specific discipline which contributes to IT Security, in favor of creating an overall perspective that goes across these disciplines and lets students take a broad perspective to:
- Identifying and mitigating risk
- Making IT decisions that align security with business value
- See the gaps in security that occur across disciplines
- Align various experts from various disciplines to creating a secure solution that actually works.
- Protect the company from a legal standpoint - knowing enough about the law and forensics to make sure that the company operates legally, and that should prosecution of an attacker be necessary, the data provided by techology can be used as evidence
So in any program these days, I'd expect to see a minimal bit of:
- Programming - both hacking and secure software development
- Operating system security
- Network Security
- Web app security (yes, some programming but also the application layer network stuff)
- Physical security
- Social engineering/human policy
With that diverse of a topic set, I'm not surpised that programming (or any single discipline) is only taking a small part of the cirriculum.
The hiring market today
I leap to this mostly because the #1 reason people pursue education is to get a job. The key to getting a job is to have the skills that people will pay you for.
Since there really is no predent yet, there's not a single job that recruits exclusively for this type of degree. Key areas that are looking for heavy security knowledge include:
- Pen tests - probably the most "glamorous" field - the one everyone thinks of - testing a secure system for cracks and helping to provide input to fixing weaknesses - takes some programming, but as important is a detailed knowledge about what you are trying to break into - products, protocols and human weaknesses.
- Audit - reviewing (not pen testing) systems for compliance with security regulations.
- Operations - running and making day to day decisions about systems with a high degree of security risk - more likely to require superior debugging skills and judgement than programming knowledge.
- IT security implementation - upgrading, and creating new components for secure systems
- Risk management - decisions and strategy about the risk of the current state of the system and the risk of making suggested changes to it.
Only a fraction of these jobs currently require hacking expertise or serious programming skills. Most require some depth of knowledge about key security controls and an ability to learn and review security controls in light of the capabilities of hackers.
Evolution in progress
Security related cirriculums are very much in transition. Professional groups I work with now are actively engaged in revising and refining these programs - they are very new and still very much in transition. The trick I see as a hiring manager is that there's a rock and a hard place right now - the key jobs in security that are very hard to fill take serious technical expertise, great communication skills, and good judgement. The way these roles are filled right now is with people who are usually 10+ years into their careers - they've gained technical depth in key areas through previous work, they've survived some serious challenges that gave them good judgement and they've spent enough time communicating to have gotten better at it.
Ideally, those of us in the industry will find ways to leverage new college grads to fill in some of this work and leverage our experienced folks as guides and mentors - like other technology disciplines. The trick is - there's no one sized fits all program yet. Risk, cost, the nexus of technology and people - that's more or less transferable job to job. But the details that each roll needs has typically been so company specific that it's hard to fill.
Computer & Network Security - specifically
This particular course is branded as Computer and Network Security, specifically, which is - IMO - rather enticing. I've seen IT Security, and CyberSecurity and the open ended nature of these titles always makes me worry. At least computer & network security suggests a program centering around ... well... computers and networks!
Taking the program in smaller detail, and going back to my main points:
- Identifying and mitigating risk - hard to tell in this cirriculum - there's a principles and practices - but I'd have to read a description to see if they agree with me on risk mitigation as a "best practice".
- Making IT decisions that align security with business value - maybe - there's some intro economics here, but one wonders how close to IT it really gets...
- See the gaps in security that occur across disciplines - hopefully - but this is really hard to teach
- Align various experts from various disciplines - yep - the various SEC courses are doing a decent job - some OS (LINUX and Windows), some networking (there's a 101 telecom sounding course, and also one on networking security controls)
- Protect the company from a legal standpoint - nice - the CRJ and LES courses are pretty enticing - assuming the course is of high quality, the philosophy course on ethis is nice, too.
If I were interviewing a candidate and saw this degree, the first step would be to do what I'm doing now. I'd also:
scope out other graduates - what fields are they working in? This looks forensic heavy - are candidates working primarily law enforcement?
Interview for content - certainly the basics look good - can the candidate really configure the security controls I'll need him to configure? How hands on was any of this work (not programming - staging, fixing and installing computer systems and network gear)
look for project work focusing on interdisciplinary collaboration - if you can't work with people who think differently, you won't work in most security jobs.
As a graduate - I'd have one more question -- how many of your professors are working in the field? The field is growing and changing rapidly - if your profs aren't getting in and doing hands on work, then you're getting a theory based education and you may have to unlearn much of what you've learned when you get to a job. A real key in this area is having the opportunity to work with people who have knowledge of the industry and whose theories have been proven in practice.
