When I took my first information security course, what made me interested in the field was some of the hard problems that were used to provide security (like public key crypto, hashing functions, etc.) However, I soon realized that while that knowledge is great (and probably a prerequisite) to understand a lot of security, it doesn't translate to direct skill in the industry.
From what I've been seeing in my (relatively short) time in the industry, it is moving towards a world where everyone needs to be aware of security. There used to be a time when there were a bunch of "those security nerds" and then everyone else who didn't worry about security. With the explosion of web applications, and how easy it is to set them up, to me, the most important thing, especially for people who are going into the software world, is to learn application security.
That said, for an introductory course, I would start with the very basic of things:
- The need for security (essentially the CIA triad, and communicating privately in a public world. I would even recommend certain chapters from this great network security book, even though it's a tad expensive). I would follow this up with an exercise where they have a set of problems where they need to figure out which of the CIA triad is necessary. (For example, you're you're posting public messages on a forum for everyone to read. Which of the three pillars of security does this need? - problems like this, more creative, obviously)
- The basics of cryptography - a brief history of it, symmetric crypto, asymmetric crypto, hashing, MAC, etc. Again, the book above is an excellent resource.
- Include a few papers as recommended reading - Smashing the stack for fun and profit, a really old paper on some of the famous internet worms, and a few others that I will add in once I remember them. This can be optional, though I learned a whole bunch of things from some of these papers. As a follow up to this, perhaps have an assignment where they do a basic buffer overflow exploit (this seems to be a good example for Linux, and this seems to be a good one for Windows).
- While a prerequisite maybe networking knowledge, it wouldn't hurt to go into the basics of Network Security. My own knowledge here isn't up to mark, but things I remember learning about are IPSEC, vulnerabilities in DNS and DNSSEC, Firewalls, IDS/IPS, how SSL works, etc. This could be followed up with an exercise in setting up a Firewall with a specific set of rules, or setting up Snort to alert on a set of rules, etc.
- Web application security - going through the OWASP Top 10 is great. I would focus on secure coding principles if your target audience is primarily engineers; even otherwise, focus on why application security is important. There are plenty of examples out there, Adobe being one of the latest to join the group of "oh shit we did that wrong". This I would say would be where you would go into more detail than the previous topics. A follow up exercise here could be setting up Mutillidae or WebGoat and walking through the OWASP Top 10. Perhaps even make the students write applications, and then make each of them test another team's application (this can be particularly effective for teaching secure coding and dynamic testing)
- Mobile Application Security: Yes, this is important. All the vulnerabilities that we thought went away from webapps, we are now seeing in mobile apps. OWASP Mobile Security Project made a decent attempt at covering some of the vulnerabilities, I would suggest building something off of that. An exercise for this could be something similar to what you did above.
- Physical Security: A lot of people would say this should be at the top, and I might even agree. All the network and application security in the world is useless if you aren't securing things physically. There's a lot of resources and talks available on the Internet (this talk is a really good thing to start off of).
- Social Engineering - both from an offensive side and a defensive side. There's a lot of resources for this one as well, and I am going to shamelessly include my own answer here as a resource.
- Open Source Intelligence (OSINT) - yes, this is becoming more and more important these days. The things that people leave on the Internet inadvertently increases everyday. Shane's talk at Derbycon 2013 is an awesome resource.
- The basics of Offensive Security Tools - things like Metasploit, nmap (though this isn't really just for offensive security), Nessus/Nexpose, Burp, all the other related tools. Perhaps set up a lab where they can practice using these tools (again, Metasploitable, Webgoat, Damn Vulnerable Webapp, etc. are great resources).
- Wrap it all up - perhaps create a CTF-like challenge where they get to use all the skills they learned. It doesn't have to be super extensive or very hard, just something where they get to apply what they learned in some way, so that it doesn't leak out of their head.
If the topics above are too many for the duration of the class, I would even suggest asking the class for what they want to learn, and pruning based on that. Quality over quantity and all that.
I've covered everything that I would have liked to learn from my introductory security course. I would emphasize that you build this course with a focus on practical skills - things they can use going right out of the class. That is one of the biggest things that I've heard people complain about from introductory security courses, so building one with the aim of practical knowledge would be very useful.