EDU: Motivating and Reaching University Students and Professionals with Software Security Education

该项目涉及向大学生和专业人员开发和提供软件安全教育，并向教育工作者分发课程材料，使他们能够在整个课程中进行有效的安全教育。向所有学生和教育工作者提供了一个大型的、故意易受攻击的电子健康记录(EHR)应用程序，以及支持课程的相关构件。EHR应用程序的实例托管在虚拟环境中，以便学生可以获得自己的虚拟实例并练习对系统的攻击，从而使攻击得到遏制/安全，并且不会造成实际损害。所有课程资源都免费提供给教育工作者。学生在以实验室为基础的课程中接受教育，通过积极的学习练习实现学习目标。专业人士可以选择通过大规模开放在线课程(MOOC)学习课程，也可以通过随时可用的系统学习课程。这些教育做法：(A)提高从业人员和学生对软件安全相关问题的知识水平；(B)提高对两种形式的在线教育和大学课堂主动学习的理解。这项研究通过为软件安全提供开放资源和教育模块来增强基础设施。这项工作提高了从业者生产安全可靠软件产品的能力，使人们能够合理地依赖计算机系统安全地执行关键功能。

This project involves the development and delivery of software security education to university students and professionals, and the dissemination of curricular materials to educators to enable effective security education throughout their courses. A large intentionally vulnerable electronic health record (EHR) application with associated artifacts to support the lessons is provided to all student and educators. Instances of the EHR application are hosted in a virtual environment such that students can get their own virtual instance and practice attacks against the system whereby the attacks would be contained/safe and not cause actual damages. All curricular resources are made freely available to educators. Students are educated in a laboratory-based course with learning objectives met through active learning exercises. Professionals are provided with options for taking the course via a Massively Open Online Course (MOOC) or by taking a course through an always-available system. The educational practices (a) increase the knowledge level of practitioners and students in issues related to software security; and (b) increase the understanding of two forms of online education and on active learning in the university classroom. The research enhances the infrastructure by providing open resources and educational modules for software security. The work improves the ability of practitioners to produce secure and reliable software products so that people can justifiably rely upon computer systems to perform critical functions securely.