Building a serious game to teach secure coding in introductory programming

（35）本项目设计并构建了一个严肃的游戏原型，用于帮助学生开发安全编码能力，并开发了高质量的入门级计算实验室练习，将游戏活动作为实验室作业的一部分。之所以选择一款严肃的游戏，是因为玩游戏可以让学生探索更复杂的主题，而不是像入门编程课那样从头开始编程，而且许多学生喜欢玩电子游戏。越来越多的人意识到需要将安全性作为软件开发的设计标准来考虑。它的引入不能推迟到学生上高年级时，当他们被教授安全编码课程时。这个项目的愿景不是将安全编码作为一个独立的主题引入已经拥挤不堪的计算机入门课程，而是将其整合到课程中的实验练习中，将安全视为学生学习传统编程/解决问题组件的上下文。这个项目的优点是：1)教初级程序员安全编码，并开发一种机制，让他们从一开始就安全编程；2)建立一个严肃的游戏，以加强安全编码实践和原则的教学；3)利用安全背景创建高质量的实验室材料，作为传统面向对象编程和问题解决主题的教学手段；4)评估这个游戏和这些实验材料的有效性。该项目与两个NSF先进技术教育中心、网络安全教育联盟和网络观察中心合作。这些中心正在试用这些材料，并充当传播工具。这项工作的结果将在信息系统安全教育研讨会以及更传统的计算机教育会议上发表。

Computing - Other (35)This project is designing and building a serious game prototype for use in helping students to develop secure coding abilities, and is developing high-quality introductory computing laboratory exercises that incorporate game activities as part of laboratory assignments. A serious game has been chosen because the playing of a game allows students to explore topics more sophisticated than they would normally be able to program from scratch as part of an introductory programming class, and because many students enjoy playing video games. Increasingly, there is awareness that security needs to be considered as a design criterion for software development. Its introduction cannot be delayed until students are upperclassmen when they are taught a class in secure coding. Rather than introduce secure coding as a stand-alone topic into an already over-crowded introductory computing class, this project's vision is to integrate it into the laboratory exercises within the course, treating security as a context within which students learn traditional programming/problem solving components. The merits of this project are: 1) teaching beginning programmers about secure coding, and to develop a mechanism to have them programming securely from the start; 2) building a serious game to augment the teaching of secure coding practices and principles; 3) creating high-quality laboratory materials using the context of security as a means of teaching traditional object-oriented programming and problem solving topics; and 4) assessing the effectiveness of this game and these laboratory materials.This project works with two of the NSF Advanced Technological Education Centers, the Cybersecurity Education Consortium and the CyberWatch Center. These centers are piloting the materials and serving as dissemination vehicles. The results of this work are presented at the Colloquium for Information System Security Education, as well as at more traditional computing education conferences.