Building a serious game to teach secure coding in introductory programming

点击翻译按钮获取中文摘要

Computing - Other (35)This project is designing and building a serious game prototype for use in helping students to develop secure coding abilities, and is developing high-quality introductory computing laboratory exercises that incorporate game activities as part of laboratory assignments. A serious game has been chosen because the playing of a game allows students to explore topics more sophisticated than they would normally be able to program from scratch as part of an introductory programming class, and because many students enjoy playing video games. Increasingly, there is awareness that security needs to be considered as a design criterion for software development. Its introduction cannot be delayed until students are upperclassmen when they are taught a class in secure coding. Rather than introduce secure coding as a stand-alone topic into an already over-crowded introductory computing class, this project's vision is to integrate it into the laboratory exercises within the course, treating security as a context within which students learn traditional programming/problem solving components. The merits of this project are: 1) teaching beginning programmers about secure coding, and to develop a mechanism to have them programming securely from the start; 2) building a serious game to augment the teaching of secure coding practices and principles; 3) creating high-quality laboratory materials using the context of security as a means of teaching traditional object-oriented programming and problem solving topics; and 4) assessing the effectiveness of this game and these laboratory materials.This project works with two of the NSF Advanced Technological Education Centers, the Cybersecurity Education Consortium and the CyberWatch Center. These centers are piloting the materials and serving as dissemination vehicles. The results of this work are presented at the Colloquium for Information System Security Education, as well as at more traditional computing education conferences.