Evaluating Two Methods for Integrating Secure Programming Education

Security vulnerabilities are still prevalent in today's software, yet many can be prevented with standard secure programming techniques. Thus, educators of future developers need to teach students not just how to program, but how to program securely. Many researchers advocate integrating secure programming knowledge and skills across the computer science curriculum. In this paper, we report the results of a study comparing two such methods: our own tool ESIDE, which provides students with security warnings on assignment code, and a security-clinic approach, a one-on-one session with a teaching assistant. Both methods suffered from challenges in incentivizing students to incorporate secure programming techniques into their code. We discuss the relative strengths and weaknesses of these methods, and the challenges of timing and motivation of secure programming education.