skip to main content

Explore Research Products in the NSF-PAR

Title: Exercise Perceptions: Experience Report from a Secure Software Development Course
The ubiquitous use of software in critical systems necessitates integrating cybersecurity concepts into the software engineering curriculum so that students studying software engineering have adequate knowledge to securely develop software projects, which could potentially secure critical systems. An experience report of developing and conducting a course can help educators to gain an understanding of student preferences on topics related to secure software development. We provide an experience report related to the ‘Secure Software Development’ course conducted at Tennessee Technological University. We discuss student motivations, as well as positive and negative perceptions of students towards exercises. Based on our findings, we recommend educators to integrate real-world exercises into a secure software development course with careful consideration of tool documentation, balance in exercise diversity, and student background.  more » « less
Award ID(s):
2026869
NSF-PAR ID:
10293099
Author(s) / Creator(s):
; ;
Editor(s):
Paiva, A.C.R.; Cavalli, A.R.; Ventura, Martins P.; Perez-Castillo, R.
Date Published:
Journal Name:
Quality of Information and Communications Technology (QUATIC) 2021
Volume:
1439
Format(s):
Medium: X
Sponsoring Org:
National Science Foundation
More Like this
  1. ( , Proceedings of the 2023 Annual Conference and Exposition of the American Society for Engineering Education)
    The Computing Curricula 2020 (CC2020) report, issued by the ACM and IEEE Computer Society, identified knowledge, skills, and dispositions as the three main components of competency for undergraduate programs in computer engineering, computer science, cybersecurity, information systems, information technology, and software engineering, as well as data science. As earlier generations of curricular guidelines in computing have described knowledge and skills to some extent, the notion of dispositions is relatively new to computing. Dispositions are cultivable behaviors, such as adaptability, meticulousness, and self-directedness, that are desirable in the workplace. Multiple employer surveys and interviews confirm that dispositions are as crucial for success in the workplace as the knowledge and skills students develop in their academic programs of study. As such, the CC2020 report describes eleven dispositions that are expected of competent computing graduates. These are distinct and separate from the technical knowledge and disciplinary skills of computing and engineering. Dispositions are also distinct from baseline or cross-disciplinary skills, such as critical thinking, problem-solving, teamwork, and communication. In contrast, dispositions are inherently human characteristics that describe individual qualities and behavioral patterns that lead to professional success. Dispositions are learnable, not necessarily teachable. This work-in-progress paper motivates dispositions within computing disciplines and presents the background of this approach. It also discusses the use of reflection exercises and vignettes in understanding, promoting, and fostering behavioral patterns that undergraduate computing students identify as related to dispositions they experience in the course. Preliminary data and results from the study are also presented. 
    more » « less
  2. ; ; ; ; ; ( , ASEE Conferences)
    The Computing Curricula 2020 (CC2020) report, issued by the ACM and IEEE Computer Society, identified knowledge, skills, and dispositions as the three main components of competency for undergraduate programs in computer engineering, computer science, cybersecurity, information systems, information technology, and software engineering, as well as data science. As earlier generations of curricular guidelines in computing have described knowledge and skills to some extent, the notion of dispositions is relatively new to computing. Dispositions are cultivable behaviors, such as adaptability, meticulousness, and self-directedness, that are desirable in the workplace. Multiple employer surveys and interviews confirm that dispositions are as crucial for success in the workplace as the knowledge and skills students develop in their academic programs of study. As such, the CC2020 report describes eleven dispositions that are expected of competent computing graduates. These are distinct and separate from the technical knowledge and disciplinary skills of computing and engineering. Dispositions are also distinct from baseline or cross-disciplinary skills, such as critical thinking, problem-solving, teamwork, and communication. In contrast, dispositions are inherently human characteristics that describe individual qualities and behavioral patterns that lead to professional success. Dispositions are learnable, not necessarily teachable. This work-in-progress paper motivates dispositions within computing disciplines and presents the background of this approach. It also discusses the use of reflection exercises and vignettes in understanding, promoting, and fostering behavioral patterns that undergraduate computing students identify as related to dispositions they experience in the course. Preliminary data and results from the study are also presented. 
    more » « less
  3. ; ; ; ( , 2020 ASEE Virtual Annual Conference)
    Security is a critical aspect in the design, development, and testing of software systems. Due to the increasing need for security-related skills within software systems and engineering, there is a growing demand for these skills to be taught at the university level. A series of 41 security modules was developed to assess the impact of these modules on teaching critical cyber security topics to students. This paper presents the implementation and outcomes of the first set of six security modules in a Freshman level course. This set consists of five modules presented in lectures as well as a sixth module emphasizing encryption and decryption used as the semester project for the course. Each module is a collection of concepts related to cyber security. The individual cyber security concepts are presented with a general description of a security issue to avoid, sample code with the security issue written in the Java programming language, and a second version of the code with an effective solution. The set of these modules was implemented in Computer Science I during the Fall 2019 semester. Incorporating each of the concepts in these modules into lectures depends on both the topic covered and the approach to resolving the related security issue. Students were introduced to computing concepts related to both the security issue and the appropriate solution to fully grasp the overall concept. After presenting the materials to students, continual review with students is also essential. This reviewal process requires exploring use-cases for the programming mechanisms presented as solutions to the security issues discussed. In addition to the security modules presented in lectures, students were given a hands-on approach to understanding the concepts through Model-Eliciting Activities (MEAs). MEAs are open-ended, problem-solving activities in which groups of three to four students work to solve realistic complex problems in a classroom setting. The semester project related to encryption and decryption was implemented into the course as an MEA. To assess the effectiveness of incorporating security modules with the MEA project into the curriculum of Computer Science I, two sections of the course were used as a control group and a treatment group. The treatment group included the security modules in lectures and the MEA project while the control group did not. To measure the overall effectiveness of incorporating security modules with the MEA project, both the instructor’s effectiveness as well as the student’s attitudes and interest were measured. For instructors, the primary question to address was to what extent do instructors change their attitudes towards student learning and their teaching practices because of the implementation of cyber security modules through MEAs. For students, the primary question to address was how the inclusion of security modules with the MEA project improved their understanding of the course materials and their interests in computer science. After implementing security modules with the MEA project, students showed a better understanding of cyber security concepts and a greater interest in broader computer science concepts. The instructor’s beliefs about teaching, learning, and assessment shifted from teacher-centered to student-centered, during his experience with the security modules and MEA. 
    more » « less
  4. ( , 2021 ASEE Virtual Annual Conference Content Access)
    A solid understanding of electromagnetic (E&M) theory is key to the education of electrical engineering students. However, these concepts are notoriously challenging for students to learn, due to the difficulty in grasping abstract concepts such as the electric force as an invisible force that is acting at a distance, or how electromagnetic radiation is permeating and propagating in space. Building physical intuition to manipulate these abstractions requires means to visualize them in a three-dimensional space. This project involves the development of 3D visualizations of abstract E&M concepts in Virtual Reality (VR), in an immersive, exploratory, and engaging environment. VR provides the means of exploration, to construct visuals and manipulable objects to represent knowledge. This leads to a constructivist way of learning, in the sense that students are allowed to build their own knowledge from meaningful experiences. In addition, the VR labs replace the cost of hands-on labs, by recreating the experiments and experiences on Virtual Reality platforms. The development of the VR labs for E&M courses involves four distinct phases: (I) Lab Design, (II) Experience Design, (III) Software Development, and (IV) User Testing. During phase I, the learning goals and possible outcomes are clearly defined, to provide context for the VR laboratory experience, and to identify possible technical constraints pertaining to the specific laboratory exercise. During stage II, the environment (the world) the player (user) will experience is designed, along with the foundational elements, such as ways of navigation, key actions, and immersion elements. During stage III, the software is generated as part of the course projects for the Virtual Reality course taught in the Computer Science Department at the same university, or as part of independent research projects involving engineering students. This reflects the strong educational impact of this project, as it allows students to contribute to the educational experiences of their peers. During phase IV, the VR experiences are played by different types of audiences that fit the player type. The team collects feedback and if needed, implements changes. The pilot VR Lab, introduced as an additional instructional tool for the E&M course during the Fall 2019, engaged over 100 students in the program, where in addition to the regular lectures, students attended one hour per week in the E&M VR lab. Student competencies around conceptual understanding of electromagnetism topics are measured via formative and summative assessments. To evaluate the effectiveness of VR learning, each lab is followed by a 10-minute multiple-choice test, designed to measure conceptual understanding of the various topics, rather than the ability to simply manipulate equations. This paper discusses the implementation and the pedagogy of the Virtual Reality laboratory experiences to visualize concepts in E&M, with examples for specific labs, as well as challenges, and student feedback with the new approach. We will also discuss the integration of the 3D visualizations into lab exercises, and the design of the student assessment tools used to assess the knowledge gain when the VR technology is employed. 
    more » « less
  5. ; ; ; ; ; ( , Proceedings of the International Conference on Software Engineering)
    null (Ed.)
    Lack of security expertise among software practitioners is a problem with many implications. First, there is a deficit of security professionals to meet current needs. Additionally, even practitioners who do not plan to work in security may benefit from an increased understanding of security. The goal of this paper is to aid software engineering educators in designing a comprehensive software security course by sharing an experience running a software security course for the eleventh time. Through all the eleven years of running the software security course, the course objectives have been comprehensive -- ranging from security testing, to secure design and coding, to security requirements to security risk management. For the first time in this eleventh year, a theme of the course assignments was to map vulnerability discovery to the security controls of the Open Web Application Security Project (OWASP) Application Security Verification Standard (ASVS). Based upon student performance on a final exploratory penetration testing project, this mapping may have increased students' depth of understanding of a wider range of security topics. The students efficiently detected 191 unique and verified vulnerabilities of 28 different Common Weakness Enumeration (CWE) types during a three-hour period in the OpenMRS project, an electronic health record application in active use. 
    more » « less
  • Citation Formats
  • MLA
  • APA
  • Chicago
  • BibTeX
  • Save / Share this Record
  • Send to Email