Experiences with teaching secure data management

In recent years, information security and assurance has received considerable attention from the computing community, with universities revamping course offerings in areas such as cryptography, network security, enterprise systems security, secure coding, and digital forensics. Although secure data management (SDM) is a major facet of overall information systems security, it has received less attention than it deserves. However, at the Rochester Institute of Technology, an SDM course has been offered since 2003. This course covers both commercial practice and current research, and has been revised continually to keep the technical content current, and to incorporate active learning approaches; additionally course delivery has moved from a traditional classroom lecture setting to a blended and fully online (distance delivery) setting. On the practical side, student projects involve the design and development of secure database applications on hardened database servers, and include an attack phase when students get to break into other student projects. On the research side, students explore current topics in the literature and incorporate aspects of their research readings into their implemented projects. This paper discusses the SDM course, some measurements of student learning, and other experiences with the course.