When someone says we should teach "cyber security" what does that mean to you? Is it computer science or system management or some mix of the two? What would you include in a course on cyber security that would make it a real computer science course?
The course that I offered was all about gdb, hexdumps, buffer overflows, and format string vulnerabilities. As a textbook, we used Hacking, by Jon Erickson. AP CS A was a prerequisite of the course, though I permitted students to join the class if they were currently enrolled in that course, as long as we had a discussion outlining expectations first. There were no mathematical prerequisites.
The course was designed with the assistance of a Navy officer. The students practiced fuzzing and hacking (admittedly insecure) programs on old, virtual systems. This was quite deliberate! I didn't start by asking, "what will the kids be able to gain entry into at the end?" Instead, I posed this question to the officer: "High school students are also quite young, so there is little pressure to give them useful skills right now. CTF competitions abound, and my students are already joining those. What is hard to pick up from CTFs, but nevertheless is ultimately quite central? What can we offer them that will help them develop into top minds in this field in the future?" And that became the central mantra of the course.
Everything was done by hand at a *nix prompt, and they got a fair amount of practice reading and examining hexdumps. By the end, they could look at a hexdump and see at a glance where, for instance, the text strings were stored.
It was ultimately a computer science course on binary and hexadecimal, on system variables, and on the intricate operations of a runtime stack. As an additional bonus, they all got pretty adept at navigating a bash prompt. The students kept asking for network hacking as well, though we didn't have time to get that far.
The material was quite dense and unintuitive. (Though, I suppose, if these practices were intuitive, they wouldn't have been vulnerabilities in the first place.) It was an extremely difficult class, although the material itself kept the kids pretty interested, so you will have that working in your favor if you go down this road.
I have taught various levels of Information Security, from basic security at schools and university to "extreme hacking" for experienced professionals at global security consultancies. Currently I'm the Research Director for ISACA Scotland, with a remit to work with Education to build syllabi and training for the next generation of security practitioners, and I have a fairly broad view on what should be incorporated here. It does make for multiple books, but as headline topics, I'd suggest:
- system architecture (Windows, Unix, others)
- a variety of languages (assembler, Object Oriented, classic languages such as COBOL, Forth, java etc)
- Security concepts (safes, locks, alarms etc) and their relationship to cyber concepts (firewalls, IDS etc)
- entry level Crypto
- capture the flag
- red and blue teaming
- social engineering
- containers, virtualisation, cloud and everything-as-a-service
- logs and logging
But there is so much more you could add in... Probably worth getting the syllabus from various universities and schools with security faculties, and build from them.
And more importantly, visit Security Stack Exchange where security queries can be tackled by heaps of skilled and experienced security practitioners.
An important and fairly contained topic is to introduce the impact of technology changing. As software designers, we will make assumptions which have a critical impact on security. Bunnie interposed a break-out connector on his Xbox ROM, and now we have OpenCV to read ROMs directly. Assumptions about how much crypto $100 of compute will buy you change (sometimes in big steps - 10 years ago, you couldn't buy fast cycles without buying the hardware yourself). BGA reflow used to be an expert operation (with X-ray analysis), now people go it in their toaster...
These changes over time mean that the attack surface will also tend to expand - complex indirect hacks can become trivial.
The impact of this is that any secuity system which can't be updated will become insecure - fairly certainly.