With the inevitable move towards an interconnected electronic society, the security of electronic interactions and data, and the software that handles them, is emerging as an important enabling criterion. The ability to write secure and trustworthy code - and not just code that complies with the system specifications - has become a very important skill that modern software developers must have.

We currently teach our students systems analysis and design skills, programming principles, database design, communications and network concepts. Unfortunately, this set of skills is no longer sufficient in an Internet-centric world. The ability to develop secure code, designed to withstand malicious attacks, has become an essential skill, which needs to be taught along with all the other software development skills. Our degrees do not currently have a strong focus on software security issues. The security-related units that we currently offer focus on general security concepts or on network security issues. There are no specific units dealing with the principles and practices of developing secure and trusted code (even though some lecturers do cover aspects of security pertinent to their unit).

In order to address this gap in our degrees we need to introduce a new unit that will highlight the most common software vulnerabilities, threats and countermeasures, as well as the best practices for developing secure and trusted software. This would be a 3-rd year unit, as it has to be based on prior programming experience, database design skills and understanding of networks.

30/11/2017 - Unit disestablished at FEC 5/17 Item 7.3.

May 2014 (Admin update) - Changing objectives to learning outcomes for AQF compliance.

September 2012: Added FIT1040 as an alternative prerequisite to FIT1002 for 2013. Approved by CE (Phu Dung Le) via email 24/08/2012.

This unit has been updated as part of a 2009 review and comparison of data with current Handbook, Syllabus + and Callista data. This unit has been updated with the new pre-req as advised by Judi Robinson.

This is a third level core unit in the Bachelor of Information Technology and Systems (BITS) major in Security.

While FIT3031 and FIT3015 aim to teach students about securing information using the computer and network infrastructure, this unit looks at securing information by securing the software that creates, accesses and modifies the information. This unit requires students to have programming knowledge and exposure to security technologies and issues.

Producing software developers who can build secure software and systems is implicitly be a part of what it means to be a software developer. Students undertaking a Security major need skills in this area.

On successful completion of this unit students should be able to:

020113

Students are introduced to some of the most common security issues involved in the development of software, including secure coding practices, secure database access, secure data communications, security of web applications, use of encryption techniques and security testing. Students are provided with a range of practical exercises to reinforce their skills, including authenticating and authorising users programmatically, user input validation, developing secure web, mobile/wireless and database applications, encrypting and hashing data programmatically, generating digital signatures programmatically, security testing, designing logging and auditing mechanisms.

On-campus

Examination (3 hours): 60%; In-semester assessment: 40%

Minimum total expected workload equals 12 hours per week comprising:

(a.) Contact hours for on-campus students:

(b.) Additional requirements (all students):

This unit requires crash-and-burn labs. The reason for adding this part is for the school to do the timetabling correctly. The unit has been conducted with the crash-and-burn labs since 2008.

FIT

One of FIT1040 or FIT1002 and one of FIT2078 or FIT1019