New master's program tackles security from many angles

In the field of security, it’s not always enough to know how to create a technically secure network. You need to know how to get people to use it properly. And if the system is breached, you need to know how to track down the offender.

To address these issues, the College of Computer and Information Science and the College of Criminal Justice are joining forces to offer an interdisciplinary MS degree program in information assurance. Courses will begin this spring.

“Security has a lot to do with social context,” says Professor Agnes Chan, associate dean and director of graduate programs, who spearheaded the effort to create the new degree program. “If your infrastructure is technically excellent but not user-friendly, people won’t use it. All that technology is useless.”

Another problem security professionals face in the real world is cost-benefit ratios. “There’s no such thing as one hundred percent secure,” Chan says. “A business has to decide how much risk it is willing to take, and how much it is willing to spend to reduce risk. These are not computer science questions. They involve economics and business.”

But perhaps the thorniest problems are those that involve legal issues. “Telecommunications and other high-tech industries are governed by regulations,” Chan says. While a computer scientist might know how to get evidence about who is committing a cyber crime, that evidence may not be admissible in court. “Criminal justice is concerned with forensics—how to gather evidence and trace criminal acts in the best way.”

Chan, who also led CCIS’s successful effort to become an NSA-designated Center of Academic Excellence in Information Assurance Education two years ago, says she got the idea for the interdisciplinary degree program from attending information assurance conferences and learning about other successful initiatives. She says many computer science programs team up with political science, psychology, and law. Very few have partners in law enforcement. With Northeastern’s nationally recognized criminal justice program right across campus, the alliance was a natural.

“CCIS can’t provide expertise in every aspect of information assurance,” she says. “This program will allow us to draw on other experts to educate security professionals with the necessary range of skills.”