What did OP mean by "secure client/server architecture" though? What are the basic/fundamental principles behind it, that are NOT covered in cybersec education?

^ I am in no way trying to be offensive here. But if you are already a programmer, with the exception of "threat modeling" and "regression tests", it seems all those topics combined would take a week to learn?

I know cybersec is extremely broad, but I think software engineering plays an extremely important role.

Speaking practically, the vast majority of companies that experience one of the vulnerabilities you are referencing are not going to be patching the code themselves - they're going to be updating their infrastructure with code that was written by someone else. And before they even get to that point, they are going to have to have policies/procedures that alert them of that vulnerability, that assess how important patching that vulnerability is, that determine cost of patching/not patching, that determine how to receive that patch, and that determine how to apply that patch. And all of those things involve much more than programming.

One of the other largest parts of defending a company from being hacked is training and protecting employees from social engineering/phishing attacks, and that's something that doesn't involve writing any code (or even knowledge of code) at all.

I didn't say there weren't?

> In my experience, the companies with the worst security are ones that primarily employ current or former software engineers as leaders of their security teams with a misguided mentality that security is just a subset of software engineering.

Wasn't what I was advocating for.

I'm advocating for learning security after you have a base of software development. Not leading a security team with no experience learning or practicing security. Also, this is a huge and growing field, so I'm speaking generally, but I'm sure there are sub-areas where there are counter examples.

I could keep going. All of these things could have some software engineering component, such as with identity management: there is a component there that deals with (for example) writing code to integrate your web app with multi-factor authentication, but identity management also encompasses things like writing good access control policies, managing the legal requirements for access, training people on how to use that multi-factor auth, etc.

Engineering skills are of course of great use if you are talking about the security of a specific codebase or doing penetration testing or doing the nitty-gritty customization of a security application, but "cybersecurity" is much more than that.

Can you elaborate? I know a lot of security teams will have large amounts of machine data thrown into ELK or Splunk, but that seems like qualitative data and so there's not a lot of number-crunching to do.

Graph Analysis => Saw some guys turn the Android codebase into a graph and use that to turn a dozen minor exploits into a chain that gave them root. Pwn2own IIRC.

Statistics => Great for detecting anomalies / understanding how to evaluate manipulation of cyber adjacent systems. For example, understanding the beta distribution lets you figure out how someone will game ratings in your app store to beat out legitimate apps with similar sounding ones. And of course all of these things cut both ways: if you're on red team it helps you masquerade more effectively.

Recommenders => Obviously useful to understand from attack detection, spam filter evasion, etc.

Linguistic analysis => De-anon attackers by the language they use. Figure out automatically which email accounts have been owned by sudden changes in speech usage.

Anecdotally, at my (one of the largest in the world) security consulting firms that hires from similar degree programs, a very small minority of people have any experience as a programmer, and a similarly small minority of our work involves writing/reading any code.

I'm not sure why you are just reposting what someone else wrote, the course and curriculum are linked to in the second sentence of the article.

It's far more solid than your incredibly spartan summary:

https://pe.gatech.edu/degrees/cybersecurity

Your list of "things that would help" are likely found in:

"Introduction to Information Security (CS 6035) A full spectrum of information security: threats, software vulnerabilities, programming for malice, basic cryptography, operating systems protections, network security, privacy, data mining, computer crime."

A course on documentation would also be prudent. Knowing the difference between policies, standards, and procedures will help you in any interview for positions above entry level. Knowing qualitative from quantitative, and being able to talk about abstract security theory, would be good too.

And some law. Some basic course so you can talk about negligence and liability without sounding like a wikipedia page.

Potential gems on the list might be the OS or networking course if they are run something like MIT's 6.828 with lots of lab coding and perhaps a bit of hand-holding, but if you can just clone last semester's 6.828 repo and get osdev'ing, why drop 10k to spend most of your time on courses that look like yawn central?

I think what I really wanted to see was a lab-focused curriculum for aspiring vulnerability researchers, so perhaps I was bound to be disappointed.

A MS is an academic degree so of course it will be heavy on the theory, and you will mainly be expected to do practical work independently on top. Same as an undergraduate degree actually, at least a good one. That stuff you call “yawn central” is the principles that will last your entire career, the stuff you learn in the lab will be obsolete in a few years.

1. Exploit a buffer overflow in a C program

2. Use Cuckoo to understand a malware attack

3. Implement CBC encryption algorithm and a brute-force algorithm to crack it

4. Demonstrate an XSRF, XSS and SQL injection attack

Remember this is an intro course and there are about 2-3 weeks per project so you won't be an expert but I'd say it makes you aware of some of the basic security attacks and how to prevent them.

Most of the jobs are with non-serious orgs. But yeah, paying $10k to get a basic bootcamp on security probably isn't going to inspire tons of confidence by employers.