An analysis of student perceptions on automated static analysis exercises related to secure software development. Presented at FIE 2021.

1. How Do Students Feel About Automated
Security Static Analysis Exercises?
Dibyendu Brinto Bose
1
Akond Rahman Hossain Shahriar
FIE 2021

2. Introduction
2
U.S. White House Executive Order
Workforce Development

3. Introduction
3
CEROC
CS @ TnTech

4. Secure Software Development: Exercises
4
Exercises
• Eight exercises
• Exercises assigned after lectures
• 14 week semester
• 12 student course

5. Exercise List
5
Git Hooks for Automated Security Static Analysis
Logging Location
Privacy Violations in Android Projects
Validation of Security Requirements
Security Smells

6. Methodology
6
Answer to RQ1
Answer to RQ2
Survey
Gradebook
Analysis

7. Findings: Performance of Students
7
Exercise Name Grades (Min.,
Median, Max.)
Completion (Min.,
Median, Max.)
Security Smells 45%, 65%, 100% 45%, 61%, 100%
Git Hooks for
Automated
Security Static
Analysis
30%, 100%, 100% 40%, 100%, 100%

8. Findings: Positive Perceptions
8
Skillset Development
Sense of Accomplishment
Practicality
Lecture Reinforcement

9. Findings: Negative Perceptions
9
Lack of Background
Artifact Management

10. Summary
10
arahman@tntech.edu
akondrahman.github.io
@akondrahman
Findings: Positive Perceptions
7
Skillset Development
Sense of Accomplishment
Practicality
Lecture Reinforcement
Findings: Negative Perceptions
8
Lack of Background
Artifact Management
Introduction
2
U.S. White House Executive Order
Workforce Development