EDU: Competing to Build Secure Systems

点击翻译按钮获取中文摘要

Even as security has long been a tenet of good programming practice, developers continue to produce insecure software resulting in a litany of data breaches and other compromises. This project aims to improve education on secure software development and add evidence to understanding methods, tools, techniques, and other factors that best contribute to writing secure code. The project centers on a novel multiphase programming competition that combines ideas from two traditionally disparate kinds of contests: those for building code and those for finding bugs in others' code. In phase one, contestants are tasked with building secure code. In phase two, contestants perform vulnerability analyses to attempt to break the code submitted by the other contestants in the first phase. The original builders finally aim to fix exploits discovered in phase two to recover lost points. Educators, practitioners, and policymakers broadly view secure code as important, and yet there is little consensus as to how best to teach and encourage secure-programming practices. By developing a competition, this project creates a setting that is more engaging to students, improving learning outcomes, and moreover enables greater insight into both practice and pedagogy through the analysis of data on how the participants approach secure programming, what techniques they use, and what methodologies succeed or fail for different programming tasks. The educational impact is significant, as the competition scales to hundreds of participants over two years, improving the design of the contest based on each offering. The artifacts and data produced by this project are made freely available to assist secure-programming endeavors across educational institutions. Finally, the students involved in the design, implementation, and execution of the contest are trained in advanced research and pedagogical methods.