Comparing Educational Approaches to Secure programming: Tool vs. TA

Authors: 

Madiha Tabassum, Stacey Watson, and Heather Richter Lipford, University of North Carolina at Charlotte

Abstract: 

The cause of many security problems is vulnerabilities in the underlying code. These vulnerabilities are the result of security mistakes made by programmers during application development, often because of lack of knowledge of the security implications of their code. Thus, educators need to teach students as future developers not only how to program, but how to program securely. Many researchers advocate integrating secure programming guidelines across the computer science curriculum. We are exploring a tool to support this goal. ESIDE (Educational Security in the IDE) is an Eclipse plug-in for Java which provides instant security warnings, detailed explanations, and auto-generated remediation code. The goal is to provide contextualized awareness and knowledge of security vulnerabilities and mitigations as students work on programming assignments within any course. In our latest study, we compare our tool against an alternative approach of using security clinics, a one-on-one session with a teaching assistant. We report preliminary findings regarding strengths and weaknesses of our tool based approach to train developers.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

BibTeX
@inproceedings {205829,
title = {Comparing Educational Approaches to Secure programming: Tool vs. {TA}},
booktitle = {Thirteenth Symposium on Usable Privacy and Security ({SOUPS} 2017)},
year = {2017},
address = {Santa Clara, CA},
url = {https://www.usenix.org/conference/soups2017/workshop-program/wsiw2017/tabassum},
publisher = {{USENIX} Association},
month = jul,
}