Collaborative Research: Supporting Secure Programming Education in the IDE

这个项目的目标是为Eclipse开发Application Security IDE （ASIDE）插件，该插件警告程序员代码中潜在的漏洞，并帮助他们解决这些漏洞。在任何编码活动中，该工具都可以作为一个随时可用的提醒和教育机会。该工具旨在解决输入验证漏洞；输出编码;认证授权；以及几个竞争条件漏洞。该项目的目标是：(a)开发和部署一个可用的工具，可以为广泛的学生和课程服务；(b)提高学生对软件安全漏洞的认识和理解；(c)在作业中增加使用安全的编程技术；(d)对其他课程目标和教师的影响最小。在三所大学的一系列编程课程中，从CS1到高级Web编程，都使用了ASIDE。该项目评估学生如何使用该工具，对作业的影响，学生的脆弱性意识，以及对课程教师的影响。所建议的方法调查将教育支持集成到IDE中是否克服了其中的一些挑战，并在学生的整个教育过程中提供了有效的培训。各种各样的学生在他们的学术和职业生涯中都可以使用ASIDE插件。该工具预计将被广泛采用，并有可能提高各级学生的安全知识。该项目对不同机构的学生有直接影响，包括HBCU和本科文理大学。ASIDE插件可以在项目网站上下载。

The objective of this project is to develop the Application Security IDE (ASIDE) plug-in for Eclipse that warns programmers of potential vulnerabilities in their code and assists them in addressing these vulnerabilities. The tool serves as an always available reminder and educational opportunity during any coding activities. The tool is designed to address input validation vulnerabilities; output encoding; authentication and authorization; and several race condition vulnerabilities.The goals of this project are: (a) develop and deploy a usable tool that can serve a wide range of students and courses; (b) improve student awareness and understanding of security vulnerabilities in software; (c) increase utilization of secure programming techniques in assignments; and (d) have minimal impact on other course objectives and instructors. ASIDE is used in a range of programming courses, from CS1 to advanced Web programming, at three universities. The project evaluates how students use the tool, the impact on assignments, students' vulnerability awareness, and the impact on the course instructors. The proposed approach investigates whether integrating educational support into an IDE overcomes some of these challenges and provides effective training throughout a student's education. The ASIDE plug-in can be utilized by a wide variety of students throughout their academic and professional careers. The tool is expected to be adopted by a wide audience and has the potential to improve the security knowledge of students at all levels. The project has a direct impact on students at multiple levels at different institutions, including an HBCU and an undergraduate liberal arts university. The ASIDE plug-in is available for download on the project's website.