EDU: Competing to Build Secure Systems

即使安全性长期以来一直是良好编程实践的原则，开发人员仍在生产不安全的软件，导致一连串的数据泄露和其他危害。该项目旨在改进安全软件开发方面的教育，并为理解最有助于编写安全代码的方法、工具、技术和其他因素提供证据。该项目以一种新颖的多阶段编程竞赛为中心，它结合了两种传统上完全不同的竞赛的想法：一种是构建代码的竞赛，另一种是在别人的代码中发现bug的竞赛。在第一阶段，参赛者的任务是建立安全代码。在第二阶段，参赛者执行漏洞分析，试图破解第一阶段中其他参赛者提交的代码。最初的构建者最终的目标是修复在第二阶段发现的漏洞，以恢复丢失的分数。教育者、实践者和决策者广泛地认为安全代码很重要，但是对于如何最好地教授和鼓励安全编程实践，几乎没有达成共识。通过开展竞赛，该项目创造了一个更吸引学生的环境，提高了学习成果，而且通过分析参与者如何进行安全编程、使用什么技术以及在不同编程任务中哪种方法成功或失败的数据，可以更深入地了解实践和教学方法。随着比赛在两年内扩大到数百名参与者，教育影响是显著的，并根据每次提供的内容改进了比赛的设计。这个项目产生的工件和数据可以免费提供，以帮助教育机构的安全编程工作。最后，参与设计、实施和执行比赛的学生将接受先进的研究和教学方法的培训。

Even as security has long been a tenet of good programming practice, developers continue to produce insecure software resulting in a litany of data breaches and other compromises. This project aims to improve education on secure software development and add evidence to understanding methods, tools, techniques, and other factors that best contribute to writing secure code. The project centers on a novel multiphase programming competition that combines ideas from two traditionally disparate kinds of contests: those for building code and those for finding bugs in others' code. In phase one, contestants are tasked with building secure code. In phase two, contestants perform vulnerability analyses to attempt to break the code submitted by the other contestants in the first phase. The original builders finally aim to fix exploits discovered in phase two to recover lost points. Educators, practitioners, and policymakers broadly view secure code as important, and yet there is little consensus as to how best to teach and encourage secure-programming practices. By developing a competition, this project creates a setting that is more engaging to students, improving learning outcomes, and moreover enables greater insight into both practice and pedagogy through the analysis of data on how the participants approach secure programming, what techniques they use, and what methodologies succeed or fail for different programming tasks. The educational impact is significant, as the competition scales to hundreds of participants over two years, improving the design of the contest based on each offering. The artifacts and data produced by this project are made freely available to assist secure-programming endeavors across educational institutions. Finally, the students involved in the design, implementation, and execution of the contest are trained in advanced research and pedagogical methods.