Teaching Data Security at University Degree Level

There is a general consensus that courses on data security at university degree level should be research-oriented and teach fundamentals of the field, i.e., items of long-term knowledge in contrast to technology-oriented system knowledge. Unfortunately, this consensus often results in courses that are either too theoretical or are outdated with respect to current developments in security technology. We argue that combining research-oriented approaches to data security education at universities with practical and system-oriented elements is no contradiction. We present the outline of a university degree curriculum that combines theoretical and practical topics in a novel way. Our approach differs from previous curricula by a unique combination of (1) extensive practical excercises and (2) research-oriented treatment of offensive techniques in data security.