Development of a Software Security Learning Environment

Security affects every software component in different types of computing systems. Many vulnerabilities and attacks on software systems are due to security weaknesses in the software itself. During the process of software specification, development, or testing, security issues are either taken into consideration insufficiently or not at all. Such software, due to internal weaknesses is prone to new attacks. By teaching secure software engineering techniques for designing and developing software modules, students would learn systematic secure software development techniques, such as defect detecting and security testing. This paper presents a series of modules that are designed to be integrated into undergraduate software engineering courses from a security perspective. The goal of the modules is to teach the building of robust software security requirements, secure software design and development, and secure software verification through a secure software development lifecycle.

As software becomes more ubiquitous and complex, the cost of software bugs continues to grow at a staggering rate. To remedy this situation, there needs to be major improvement in the knowledge and application of software validation techniques. Although there are several software validation techniques, software testing continues to be one of the most widely used in industry. The high demand for software engineers in the next decade has resulted in more software engineering (SE) courses being offered in academic institutions. However, due to the number of topics to be covered in SE courses, little or no attention is given to software testing, resulting in students entering industry with little or no testing experience. We propose a minimally disruptive approach of integrating software testing into SE courses by providing students access to a collaborative learning environment containing learning materials on testing techniques and testing tools. In this article, we describe the learning environment and the studies conducted to measure the benefits accrued by students using the learning environment in the SE courses.

The role of modern engineers as problem-definer often require collaborating with cross-disciplinary teams of professionals to understand and effectively integrate the role of other disciplines and accelerate innovation. To prepare future engineers for this emerging role, undergraduate engineering students should engage in collaborative and interdisciplinary activities with faculties and students from various disciplines (e.g., engineering and social science). Such cross-disciplinary experiences of undergraduate engineering students are not common in today's university curriculum. Through a project funded by the division of Engineering Education and Centers (EEC) of the National Science Foundation (NSF), a research team of the West Virginia University developed and offered a Holistic Engineering Project Experience (HEPE) to the engineering students. Holistic engineering is an approach catering to the overall engineering profession, instead of focusing on any distinctive engineering discipline such as electrical, civil, chemical, or mechanical engineering. Holistic Engineering is based upon the fact that the traditional engineering courses do not offer sufficient non-technical skills to the engineering students to work effectively in cross-disciplinary social problems (e.g., development of transportation systems and services). The Holistic Engineering approach enables engineering students to learn non-engineering skills (e.g., strategic communication skills) beyond engineering math and sciences, which play a critical role in solving complex 21st-century engineering problems. The research team offered the HEPE course in Spring 2020 semester, where engineering students collaborated with social science students (i.e., students from economics and strategic communication disciplines) to solve a contemporary, complex, open-ended transportation engineering problem with social consequences. Social science students also received the opportunity to develop a better understanding of technical aspects in science and engineering. The open-ended problem presented to the students was to "Restore and Improve Urban Infrastructure" in connection to the future deployment of connected and autonomous vehicles, which is identified as a grand challenge by the National Academy of Engineers (NAE). The findings of the HEPE offering revealed the effectiveness of implementing a cross-disciplinary course setting in enhancing the team learning experience of the engineering students. In the pre-survey, the similarity between the HEPE and traditional groups was observed in most surveyed constructs. HEPE students showed better performances in the majority of assessed constructs in mid-, and post-surveys than the traditional groups of engineering students. Increased trust while working with cross-disciplinary students and higher awareness and appreciation of their learning outcomes are expected to help engineering students learn non-technical professional skills and work effectively in a collaborative environment. Overall, the findings gathered from this initial HEPE offering can provide early evidence to the engineering and broader higher education community in promoting similar HEPE course offerings to advance the professional formation of engineers. In future, the findings of HEPE course offering in Spring 2020 semester will be compared with the findings of the HEPE course offering in Fall 2020 semester to investigate the consistency of the findings. In addition, future research will implement the HEPE concept in traditional engineering courses and evaluate engineering student's learning beyond the conventional/technical skills.

Clean room software engineering is a formal software development method that can strictly engineer software development and eliminate defects before they can cause serious harm. The clean room software engineering model has its own advantages and disadvantages in use. To use it in traditional software engineering, it is necessary to clarify the relationship between it and traditional software engineering methods and practices. Based on the technology and principles of the clean room software process, this paper gets the advantages and disadvantages of the clean room. Corresponding the traditional method-based software process to the key technology of the clean room, making the traditional management-based software engineering method and the tailored clean room compatible, and the software engineering practice of the clean room software process is compared with the traditional software engineering practice. To discuss the clean room and traditional software engineering, in order to expand the use of clean room methods, improve the clean room software process, and improve the quality of software.

Software engineering course is one of the core courses of computer science. The students trained in the current teaching mode can no longer meet the market demand for high-technology talents. Based on this, the research attempts to optimize the traditional software engineering teaching mode by using the project teaching method (PTM). According to the basic concept of PTM and course characteristics, the reform path of PTM in software engineering course is explored in the experiment. Then in the experiment, the indicators that affect teaching reform effect is selected and a evaluation model is built. And GA-BP algorithm is used to evaluate the effect of the evaluation model. To verify the performance of the built model and the final evaluation effect, the research results are tested from the fitness of the algorithm, error performance, prediction in the data set and other aspects. GA-BP algorithm converged when it iterated to the 18th generation, and the final fitness value was 0.61. The average error square value of GA-BP was 0.35 and the minimum error square sum of GA-BP was 0.48. Its prediction accuracy in test set and training set was 93.4% and 94.1% respectively. The maximum prediction error in the training sample was only 0.015, and the performance of the above data was better than the other three algorithms. To sum up, applying PTM to software engineering curriculum reform can achieve better teaching results.

Discovery of security vulnerabilities is on the rise. As a result, software development teams must place a higher priority on preventing the injection of vulnerabilities in software as it is developed. Because the focus on software security has increased only recently, software development teams often do not have expertise in techniques for identifying security risk, understanding the impact of a vulnerability, or knowing the best mitigation strategy. We propose the Protection Poker activity as a collaborative and informal form of misuse case development and threat modeling that plays off the diversity of knowledge and perspective of the participants. An excellent outcome of Protection Poker is that security knowledge passed around the team. Students in an advanced undergraduate software engineering course at North Carolina State University participated in a Protection Poker session conducted as a laboratory exercise. Students actively shared misuse cases, threat models, and their limited software security expertise as they discussed vulnerabilities in their course project. We observed students relating vulnerabilities to the business impacts of the system. Protection Poker lead to a more effective software security learning experience than in prior semesters. A pilot of the use of Protection Poker with an industrial partner began in October 2008. The first security discussion structured via Protection Poker caused two requirements to be revised for added security fortification; led to the immediate identification of one vulnerability in the system; initiated a meeting on the prioritization of security defects; and instigated a call for an education session on preventing cross site scripting vulnerabilities.

In this paper, we present our efforts at incorporating aspects of systems security and software security into the two-course senior capstone project sequence (Software Engineering and Senior Project courses) in the undergraduate Computer Science curriculum at Jackson State University. In this regard, we discuss: (i) the development of course modules and lab projects on security that were respectively taught and assigned to the students in the two capstone project course sequence, and (ii) the incorporation of aspects of systems and software security in the capstone projects that were conducted by our students during the academic year 2010-11. To further assist students on their capstone projects, we developed and offered two new elective courses on Systems and Software Security and Advanced Information Security in conjunction with the two capstone project courses during the Fall and Spring semesters as well as incorporated a network security module, lab projects and reading assignment to a regular Computer Networks course. We disseminate all of our course modules, lecture materials and lab project descriptions through an actively maintained website. Our approach could be adopted as a model for incorporating security in the software systems design and development courses in a computer science or software engineering curriculum.

In recent years, software security plays an important role in verifying system safety and avoiding the casualties and property losses, but it is difficult to assess system security in traditional software engineering and software test. Focusing on the software security assessment system, this paper based on the vulnerability analysis method, which takes the advantage of both qualitative analysis and quantitative analysis to assess the security of software. The major methods of domestic and foreign software security measurement are discussed. Through the comparative analysis of existing vulnerability rating system, especially the CVSS and VRSS, this paper discovers their respective advantages and proposes a more accurate rating system to obtain the final security score of the software system. An example application is provided in the paper, which shows that the assessment system we proposed is practical.

The evaluation of an advanced software engineering (SE) course is a challenging task that should be addressed as part of the course design. In this paper, we describe an implementation of the reflective practitioner perspective as part of an advanced SE course and introduce its use for feedback purposes. Reflective feedback goes beyond merely using feedback questionnaires. Furthermore, we show, using both qualitative and quantitative empirical data, that the course on which the perspective was applied meets its objectives and fosters students' awareness to the multidimensional nature of SE.

Essentially all commercial computer systems development and deployment have been driven by concerns for time-to-market, novel features, and cost, with little if any concern for assurance, reliability, or the avoidance of system security and networked vulnerabilities. Retrofitted products for the new connected world expose new vulnerabilities, because the environment changes. Security features of an existing product may not address new risks, and new security policies take effect. New features introduce unforeseen interactions between various components. Software and systems currently are related to risks under contract law rather than any more demanding liability laws. The contracts are typically inequitable, with purchasers assuming all liabilities, despite the practical impossibility of their assessing the security, reliability, or survivability characteristics of the products. Indeed, most software products come with an anti-warranty; the producer warrants nothing, and customers assume all liabilities. There is a serious lack of understanding among developers and development managers that security and survivability are different from features. Self-promoted and self-assigned “security experts” often lead to security features that are promised, but poorly conceived and poorly understood. It has been the industry’s advantage to position “security” as an added feature to other systems and computing complexes, rather than primarily a characteristic of thoughtful architecture, careful design, and meticulous engineering, coding, testing, and operation. Security does not result from modules added after the fact; it must be engineered in from the beginning. The CERT/CC database contains numerous vulnerabilities such as buffer overflows and password sniffing that are often consequences of basic system architecture and design, some of which cannot easily be retrofitted. Products are shipped with many features, but assurance is at best paid only with lip-service as part of the vendor’s marketing campaign. Lack of commercial preference regarding security favors feature-laden software and frequent shipping schedules; too often, it is more important to ship a product with promised features in the commercial world. Although this may seem to be the failure or ignorance of the industry, these features are often requested by customers who don’t have an in-depth understanding of security. If a vendor can’t deliver in time or doesn’t offer a feature for sound security reasons, the customer finds another vendor that can. The industry is not interested in research and development without payoffs. As long as the customer takes the risks, there is a great incentive to offer “nifty” features, even if these features increase the vulnerability to compromise. Evaluation of a product against a Common Criteria protection profile, for example, is not on the list of most customers. The feature-dominated production ignores security experts’ warnings, which become the first sacrifice in development organizations. Similar sacrifice is carried out by customers demanding functionality. Although gaining more interest, cryptography, computer security, and survivability are not widespread. Security issues covered in most operating system and software engineering courses can be improved. It may not be possible to expand the existing courses and squeeze more concepts within the same time frame. Instead, separate computer security courses might be added as is already practiced by some universities. But, one way or the other, security and software engineering need to be thoroughly integrated into the curriculum. Inadequate testing of features and their myriad interactions generally relegates testing to a final screen. Hardware designers have long implemented design-for-testability rule sets and supporting integral test hardware (which may occupy more than 5% of a chip). Testing engineers should be involved at the inception of development to make sure issues relating to testability and reliability are properly addressed. The software and systems industry has been allowed to develop without substantial legal oversight, under the assumption its customers were sophisticated and could manage their risk exposure appropriately. Unfortunately, even sophisticated customers cannot know their security exposure. Under such conditions, liability law may be held to override unjust contract disclaimers. If the industry will not clean up its act, it must expect the tort bar to do so.

The interactive technical electronic book, TechEBook, currently under development at the University of Central Florida (UCF), introduces a paradigm shift by replacing the traditional electrical engineering course with topic-driven modules that provide a useful tool for engineers and scientists. The TechEBook comprises the two worlds of classical circuit books and interactive operating platforms such as iPads, laptops and desktops. The TechEBook provides an interactive applets screen that holds many modules, each of which has a specific application in the self learning process. This paper describes one of the interactive techniques in the TechEBook known as Symbolic Circuit Solver (SymCirc). The SymCirc develops a versatile symbolic based linear circuit with a switches solver. The solver works by accepting a Netlist and the element that the user wants to find the voltage across or current on, as input parameters. Then it either produces the plot or the time domain expression of the output. Frequency domain plots or Symbolic Transfer Functions are also produced. The solver gets its input from a Web-based GUI circuit drawer developed at UCF. Typical simulation tools that electrical engineers encounter are numerical in nature, that is, when presented with an input circuit they iteratively solve the circuit across a set of small time steps. The result is represented as a data set of output versus time, which can be plotted for further inspection. Such results do not help users understand the ultimate nature of circuits as Linear Time Invariant systems with a finite dimensional basis in the solution space. SymCirc provides all simulation results as time domain expressions composed of the basic functions that exclusively include exponentials, sines, cosines and/or t raised to any power. This paper explains the motivation behind SymCirc, the Graphical User Interface front end and how the solver actually works. The paper also presents some examples and results to better explain the concept.

In software engineering education, large projects are widely recognized as a useful way of exposing students to the real-world difficulties of team software development. But large projects are difficult to put into practice. First, educators rarely have additional time to manage software projects. Second, classrooms have inherent limitations that threaten the realism of large projects. Third, quantitative evaluation of individuals who work in groups is notoriously difficult. As a result, many software engineering courses compromise the project experience by reducing the team sizes, project scope, and risk. In this paper, we present an approach to teaching a one-semester software engineering course in which 20 to 30 students work together to construct a moderately sized (15 KLOC) software system. The approach combines carefully coordinated lectures and homeworks, a hierarchical project management structure, modern communication technologies, and a web-based project tracking and individual assessment system. Our approach provides a more realistic project experience for the students, without incurring significant additional overhead for the instructor. We present our experiences using the approach the last 2 years for the software engineering course at The College of William and Mary. Although the approach has some weaknesses, we believe that they are strongly outweighed by the pedagogical benefits.

The Covid-19 pandemic forced many academic institutions around the world to switch to online teaching. This shift occurred suddenly and with little preparation and this method of instruction was named “emergency remote teaching”. This paper will describe the effects of emergency remote teaching on teaching a software engineering course at a Japanese university, showing how the online environment was used as an alternative to cancelling classes. Strategies for implementing active learning and for engaging students during this software engineering course will be highlighted. Based on the results and observations gathered during the teaching of this course, important conclusions will be drawn. They will constitute a starting point for planning and implementing future software engineering courses and for making sure that active learning continues to remain an essential part of the instruction process.KeywordsEmergency remote teachingActive learningSoftware engineering

In view of the demand for software professionals in current software industry and the teaching situation in universities, the necessity of researching and constructing software engineering course group is proposed; the basic principles of constructing software engineering course group is discussed, the knowledge system of software engineering courses group is analyzed, a three-segment two-lay course group is designed, the integration and division of the course contents is achieved, and the revision and recombination is promoted, the foundation is laided, in order to further improve the qua lit y o f personnel training and construction level of course group, and accomplish the scale effect of curriculum group construction.

One of the main concerns in the software industry continues to be the development of high quality software. This concern will be exacerbated as software systems become more complex. The training of software developers continues to grow in academia since more institutions are offering software engineering (SE) courses. However, the list of topics that are expected to be covered in this course leaves little or no time for topics that focus on developing quality software, such as software testing and the use of testing tools.In this paper we describe an approach that non-intrusively integrates the use of software testing tools in SE courses. The cornerstone of our approach is the interaction students have with a Web-Based Repository of Software Testing Tools (WReSTT) that contains tutorials on testing concepts and testing tools. WReSTT employs both collaborative learning and social networking features that are attractive to students. We present the results of preliminary study performed in two SE courses that show how using the resources in WReSTT can potentially impact the students' understanding of software testing and the use of testing tools.