Collaborative Research: Supporting Secure Programming Education in the IDE

该项目的目标是为Eclipse开发应用程序安全IDE（ASIDE）插件，该插件警告程序员代码中的潜在漏洞，并帮助他们解决这些漏洞。在任何编码活动中，该工具都是一个随时可用的提醒和教育机会。该工具旨在解决输入验证漏洞、输出编码、认证和授权以及若干竞态条件漏洞，该项目的目标是：（a）开发和部署一个可供广大学生和课程使用的可用工具;（B）提高学生对软件安全漏洞的认识和理解;（c）在作业中更多地利用安全编程技术;（d）开发和部署一个可供广大学生和课程使用的工具。及（d）对其他课程目标及导师的影响减至最低。ASIDE在三所大学的一系列编程课程中使用，从CS 1到高级Web编程。该项目评估学生如何使用该工具，对作业的影响，学生的脆弱性意识，以及对课程教师的影响。所提出的方法调查是否集成到IDE的教育支持克服了这些挑战，并提供有效的培训，在整个学生的教育。ASIDE插件可以被各种各样的学生在他们的学术和职业生涯中使用。该工具预计将被广泛使用，并有可能提高各级学生的安全知识。该项目对不同机构的多层次学生产生了直接影响，包括HBCU和本科文科大学。ASIDE插件可在项目网站上下载。

The objective of this project is to develop the Application Security IDE (ASIDE) plug-in for Eclipse that warns programmers of potential vulnerabilities in their code and assists them in addressing these vulnerabilities. The tool serves as an always available reminder and educational opportunity during any coding activities. The tool is designed to address input validation vulnerabilities; output encoding; authentication and authorization; and several race condition vulnerabilities.The goals of this project are: (a) develop and deploy a usable tool that can serve a wide range of students and courses; (b) improve student awareness and understanding of security vulnerabilities in software; (c) increase utilization of secure programming techniques in assignments; and (d) have minimal impact on other course objectives and instructors. ASIDE is used in a range of programming courses, from CS1 to advanced Web programming, at three universities. The project evaluates how students use the tool, the impact on assignments, students' vulnerability awareness, and the impact on the course instructors. The proposed approach investigates whether integrating educational support into an IDE overcomes some of these challenges and provides effective training throughout a student's education. The ASIDE plug-in can be utilized by a wide variety of students throughout their academic and professional careers. The tool is expected to be adopted by a wide audience and has the potential to improve the security knowledge of students at all levels. The project has a direct impact on students at multiple levels at different institutions, including an HBCU and an undergraduate liberal arts university. The ASIDE plug-in is available for download on the project's website.