Integrating Information Assurance and Security into IT Education: A Look at the Model Curriculum and Emerging Practice

Introduction In December 2001 a meeting (CITC1) of interested parties from fifteen four-year IT programs from the US along with representatives from IEEE, ACM, and ABET began work on the formalization of Information Technology as an accredited academic discipline. The effort has evolved into SIGITE, the ACM SIG for Information Technology Education. During this evolution three main efforts have proceeded in parallel: 1) Definition of accreditation standards for IT programs, 2) Creation of a model curriculum for four-year IT programs, and 3) Description of the characteristics that distinguish IT programs from the sister disciplines in computing. One of the biggest challenges during the creation of the model curriculum was understanding and presenting the knowledge area that was originally called "security". Some of us were uncomfortable with the term because it was not broad enough to cover the range of concepts that we felt needed to be covered. We became aware of a community that had resolved many of the issues associated with the broader context we were seeking, Information Assurance. Information assurance has been defined as "a set of measures intended to protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. This includes providing for restoration of information systems by incorporating protection, detection, and reaction capabilities" (National Security Agency [NSA], 2006a). The IA community and work done by IA educators became useful in defining requisite security knowledge for information technology education programs. We believe that the Information Technology Education and the Information Assurance Education communities have much to share with each other and with other computing disciplines. Over the last several months we have been presenting our evolving work at various conferences. At the 9th Colloquium for Information System Security Education in Atlanta we introduced CC2005 and IT2005 to the IA Education community (Ekstrom & Lunt, 2005). At SIGITE 2005 we presented additional results (Dark, Ekstrom & Lunt, 2005). We have also introduced these concepts to the EET community at ASEE 2006 and reported additional results at the 10th Colloquium for ISSE in Adlephi (Dark, Ekstrom & Lunt, 2006a, 2006b). In the current paper we introduce the history and current state of IT2005 and IA education to the larger IT education community. We describe how significant concepts from the Information Assurance community have been integrated into IT2005 as a "pervasive theme". We then describe how some IT programs are integrating IAS concepts into existing programs and conclude with some observations about how computing programs might begin introducing important information and security into an existing curriculum. CC2005 and IT2005 In the first week of December of 2001 representatives from 15 undergraduate information technology (IT) programs from across the country gathered together near Provo, Utah, to develop a community and begin to establish academic standards for this rapidly growing discipline. This first Conference on Information Technology Curriculum (CITC-1) was also attended by representatives from two professional societies, the Association for Computing Machinery (ACM) and the Institute of Electrical and Electronics Engineers, Inc. (IEEE), and also the Accreditation Board for Engineering and Technology, Inc. (ABET). This invitational conference was the culmination of an effort begun several months earlier by five of these universities who had formed a steering committee to organize a response from existing IT programs to several initiatives to define the academic discipline of IT. The steering committee wanted to ensure that the input of existing programs played a significant role in the definition of the field. A formal society and three main committees were formed by the attendees of CITC-1. …