Security Baselines, Compliance, and Automation

Prerequisites

• Software engineering and system-security fundamentals.
• Familiarity with Linux, scripting, CI, and configuration files.
• Understanding of basic cryptography, identity, and logging concepts.

Learning Outcomes

• Decompose security requirements into testable controls.
• Express configuration and compliance rules as policy as code.
• Collect evidence automatically and generate audit reports.
• Manage vulnerabilities, exceptions, risk acceptance, and remediation SLAs.
• Build a maintainable automation pipeline for security baselines.

Course Format

• Two meetings per week: one for core concepts and one for labs, paper discussion, or project review.
• The course proceeds over 16 weeks, each with a checkable assignment, lab, or project milestone.
• Reproducibility is required: code, configuration, data, lab logs, and reports must be reviewable by staff or peers.

Weekly Plan

Assessment

Course Project

Students build baseline automation for a service, host, container, or cloud resource set, including rules, scanning, evidence, exceptions, and remediation guidance.

Policies

• AI tools are allowed, but generated code, lab notes, and design suggestions must be reviewed by the student and disclosed in the report.
• Students may not submit code, proofs, configuration, or experimental results they cannot explain; each member must defend their own design, tests, and tradeoffs.
• Late work affects iteration grades, but the course values reproducible, auditable, and maintainable results over last-minute accumulation.