We synthesized student perceptions on student exercises related to secure software development. This was presented at the QUATIC 2021 conference.

1. Exercise Perceptions: Experience Report
From A Secure Software Development
Course
Dibyendu Brinto Bose
1
Akond Rahman Hossain Shahriar
Sep 10, 2021

2. Introduction
2
U.S. White House Executive Order
Workforce Development

3. Introduction
3
Bounty payout is highest for
software
Top vulnerabilities from
2020 are software-related

4. Introduction
4
CEROC
CS @ TnTech

5. Secure Software Development
5
Exercises
Lectures Semester-long Projects

6. Secure Software Development: Exercises
6
Exercises
• Eight exercises
• Exercises assigned after lectures
• 14 week semester
• 12 student course

7. Exercise List
7
Git Hooks for Automated Security Static Analysis
Logging Location
Privacy Violations in Android Projects
Validation of Security Requirements

8. Exercise List
8
Security Weaknesses
Security Static Analysis for Adversarial
Machine Learning
Taint Analysis
White-box Fuzzing

9. Methodology
9
Answer to RQ1
Answer to RQ2
Answer to RQ3
Survey
Gradebook
Analysis

10. Findings: Motivation
10
Academic Requirements (2 out of 12)
Gain Research Background (3 out of 12)
Career Development (7 out of 12)

11. Findings
11
0
2
4
6
8
10
12
Exercise Project Lecture
Respondent
Count
Material Best-suited for Enrollment
Motivation

12. Findings: Positive Perceptions
12
Program Comprehension
Practicality
Lecture Reinforcement

13. Findings: Positive Perceptions (Contd.)
13
Skillset Development
Sense of Accomplishment
Self Evaluation

14. Findings: Positive Perceptions (Contd.)
14
Exercise Positive Perception
Git Hook Skillset Development, Practicality
Logging Skillset Development, Lecture Reinforcement, Program
Comprehension, Practicality
Privacy Violation Skillset Development, Practicality
Security Requirements Skillset Development, Practicality
Security Smells Skillset Development, Lecture Reinforcement, Practicality,
Sense of Accomplishment
Adversarial Machine Learning Practicality
Taint Analysis Skillset Development, Program Comprehension, Practicality,
Self Evaluation
Fuzzing Skillset Development, Lecture Reinforcement, Practicality,
Sense of Accomplishment , Self Evaluation

15. Findings: Negative Perceptions
15
Limiting Documentation
Lack of Background
Artifact Management

16. Findings: Negative Perceptions (Contd.)
16
Exercise Negative Perception
Git Hook None
Logging Lack of Background, Artifact Management
Privacy Violation Limiting Documentation
Security Requirements None
Security Smells Lack of Background, Artifact Management
Adversarial Machine
Learning
Artifact Management
Taint Analysis Lack of Background, Artifact Management
Fuzzing Artifact Management

17. Implications
17
• Students prefer real-world exercises
• Good and bad of exercise diversity
• Curious case of taint analysis: background on
program analysis and recursion

18. - A list of positive perceptions related to exercises in the
’Secure Software Development’ course.
- A list of negative perceptions related to exercises in the
’Secure Software Development’ course.
- A list of students’ motivations to enroll in the ’Secure
Software Development’ course.
- A publicly available repository of materials to conduct
necessary exercises.
Our Contribution
18

19. - https://github.com/paser-group/continuous-secsoft/
- https://hub.docker.com/repository/docker/akondrahman/sec
-soft-edu-materials
Our Contribution (Contd.)
19

20. - Rater bias
- Small sample of 12 students
- Generalizability
Limitations
20

21. Summary
21
arahman@tntech.edu
akondrahman.github.io
@akondrahman
Findings: Motivation
8
Academic Requirements (2 out of 12)
Gain Research Background (3 out of 12)
Career Development (7 out of 12)
Findings: Positive Perceptions
10
Program Comprehension
Practicality
Lecture Reinforcement
Introduction
2
U.S. White House Executive Order State of Tennessee
CEROC
Workforce Development