Just read an editorial from the ACM on why we should be reaching malware to CS majors. I think we better start with RE theory and practice