Overview
This tutorial addresses the challenge of creating meaningful software examples that bridge the gap between basic tutorials and real-world complexity. Most software security tutorials use overly simplistic examples like to-do applications or focus exclusively on high-value financial data.
Purpose
The authors aim to demonstrate how integrating security principles—even when not legally mandated—can lead to cleaner implementations and lower total cost of ownership. Using an online educational platform as the example, the tutorial examines three categories of security needs:
- Areas where law mandates stronger security
- Areas where business requirements necessitate security measures
- Areas where security is not critical
Key Features Discussed
The tutorial covers eight primary system features:
- User Management - Account creation and administration
- Course Creation - Content development and organization
- Enrollment Management - Student registration and course access
- Assignment Submission - Work submission and educator review
- Grading System - Assessment and grade calculation
- Discussion Forums - Collaborative learning spaces
- Quizzes and Exams - Assessment administration
- Attendance Tracking - Student presence monitoring
Each feature has different access requirements across three user roles: administrators, educators, and students.
Approach
The tutorial operates at a theoretical level without extensive code examples, aiming to strike a balance between sufficient detail for comprehension and accessibility. The material explores security attributes including availability, confidentiality, and integrity prioritization.
Next Steps
The tutorial continues with foundational discussions on characteristics prioritization for the educational software system.