EDU: Motivating and Reaching University Students and Professionals with Software Security Education

这个项目包括为大学生和专业人员开发和提供软件安全教育，以及向教育工作者分发课程材料，以便在他们的课程中进行有效的安全教育。为所有学生和教育工作者提供了一个具有相关工件的大型易受攻击的电子健康记录（EHR）应用程序，以支持课程。EHR应用程序的实例托管在虚拟环境中，这样学生就可以获得自己的虚拟实例并练习对系统的攻击，这样攻击将被控制/安全并且不会造成实际损害。所有课程资源都免费提供给教育工作者。学生在以实验室为基础的课程中接受教育，通过积极的学习练习来实现学习目标。专业人士可以选择通过大规模开放在线课程（MOOC）或通过随时可用的系统学习课程。教育实践(a)提高从业员和学生对软件保安相关问题的知识水平；(b)增加对在线教育和大学课堂主动学习两种形式的理解。本研究通过提供软件安全的开放资源和教育模块来增强基础设施。这项工作提高了从业人员生产安全可靠的软件产品的能力，使人们可以合理地依靠计算机系统安全地执行关键功能。

This project involves the development and delivery of software security education to university students and professionals, and the dissemination of curricular materials to educators to enable effective security education throughout their courses. A large intentionally vulnerable electronic health record (EHR) application with associated artifacts to support the lessons is provided to all student and educators. Instances of the EHR application are hosted in a virtual environment such that students can get their own virtual instance and practice attacks against the system whereby the attacks would be contained/safe and not cause actual damages. All curricular resources are made freely available to educators. Students are educated in a laboratory-based course with learning objectives met through active learning exercises. Professionals are provided with options for taking the course via a Massively Open Online Course (MOOC) or by taking a course through an always-available system. The educational practices (a) increase the knowledge level of practitioners and students in issues related to software security; and (b) increase the understanding of two forms of online education and on active learning in the university classroom. The research enhances the infrastructure by providing open resources and educational modules for software security. The work improves the ability of practitioners to produce secure and reliable software products so that people can justifiably rely upon computer systems to perform critical functions securely.