The front page of Carnegie Mellon's School of Computer Science proudly boasts the university's Tartan Rescue Team finished third at the DARPA Robotics Challenge by submitting a robot called CHIMP that was built to help in disaster situations. The University of Texas at Austin's Computer Science program page brags about one of their robots, UT Austin Villa, winning RoboCup 2015. Georgia Tech's Computer Science page promotes a summer internship program called "Data Science for Social Good." I am jealous of today's computer science students. They are getting to explore so much more than I ever explored going through my computer science program. I would like to ask the Carnegie Mellon students how they plan to secure their robot when it gets connected to the Internet of Things. I'm sure that these students were taught about security implications as they were designing and building the robot, right? Maybe the advisors for UT's Austin Villa team taught them about how to secure their robot, right? Surely Georgia Tech's advisors advised the students in the summer internship program about data integrity and how to protect the data they were processing, right? I graduated way back in 2004 with a computer science degree so I have been wondering how much computer science curriculum has changed since then. Are schools teaching security as part of their core curriculum? Let's take a look.
I decided to limit the scope of this blog to the top 10 computer science programs as identified by US News. Here are the top 10 schools according to US News.
1. Carnegie Mellon University
2. Massachusetts Institute of Technology
3. Stanford University
4. University of California - Berkeley
5. University of Illinois - Urbana-Champaign
6. Cornell University
7. University of Washington
8. Princeton University
9. Georgia Institute of Technology
10. University of Texas - Austin
These schools are arguably the best in the world and are producing the brightest programmers who are doing amazing things. They can build robots that respond during disasters but can they write secure code? Based solely off the course catalogs, the answer is probably not. Many of the schools offer a selection of security courses but none are required for a student to receive a degree. A lot of schools offer graduate degrees with a focus on security so the opportunities are there. But most students are just wanting to finish their undergrad program and get out and start making money. Graduate school is an afterthought. Carnegie Mellon, the top school, only offers one class on security to undergrads. MIT doesn't offer any classes on security to it's undergrads. Berkeley offersa few security courses but they are mostly high level. What is needed is a course on secure coding which I haven not seen anywhere.
Schools are under a lot of pressure to graduate their students in four years due to mounting pressure from the government and other higher education critics who are wary of rising tuition costs. Requiring an extra class or two that focuses on security will add a semester or two to a degree which could be costly. The security community is amazing in that there are so many conferences and training opportunities at little to no cost. Heck, conferences even serve beer. Can you imagine how many college students would show up to a security conference if they knew there was free beer? As a nice side effect we would be teaching these kids security or at least making them security-aware with no additional tuition fees.
Computer science programs are accredited by ABET and must adhere to ABET's criteria. What does ABET say about security? Nothing. Without this guidance from ABET I don't believe schools will add security to the mandatory courses students must take. ABET leans on an organization called CSAB to develop the required curriculum that computer science programs must meet to be accredited by ABET. CSAB is made up of IEEE-CS and ACM. Ok, no more acronyms. I believe working with IEEE and ACM to promote security is the only way to get security to be added to the curriculum. I envision OWASP would be best positioned to get involved in this process from a security perspective.
There are some brillaint minds developing amazing applications across all industries. I would argue quality developers are writing secure code without knowing it. Secure code is really nothing but good, functional code. Security vulnerabilities are just bugs from another mother. One of these kids is going to build a medical device that is one day going to save my life. I want that little snot rag to at least be thinking about security when he's building that device. When and where will tomorrow's developers learn how to write secure code? It's 2015. We are on Web 2.0 with 3.0 probably right around the corner. Where is the Security 1.0 revolution?
No comments:
Post a Comment