检索结果-内蒙古大学图书馆

ACM Southeast Conference (ACMSE)

作者： Davis, Daniel Zhu, Feng Univ Alabama Huntsville Comp Sci Dept Huntsville AL 35899 USA

ISBN: (纸本)9781450371056

secure coding is a mission that cannot be neglected as computing devices continue increasing. Every year, thousands of new software vulnerabilities are identified. Education is a crucial factor and a significant challenge to counter cyber threats. But gaining insight into how people learn has always been challenging. There is a considerable need for improved methodologies with active hands-on educational techniques for programmers to learn practical strategies to mitigate software vulnerabilities;to protect private data;and ultimately to write secure code in the first place. To the best of our knowledge, this is the first usage of eye tracking technologies to understand secure coding practices and to improve education. We focused on exploring the ways that students comprehended and learned to develop secure software. We recorded their eye gaze movements while they studied our hands-on learning module and mitigated the weaknesses within the source code. Our study involved 29 students mitigating software vulnerabilities via manual analysis of the source code. The eye tracking data allows us to objectively study and gain insight in order to understand and improve students learning behavior. Our analysis indicates that there is a distinction in the learning phase for students that answered correctly compared to students that did not provide the correct mitigation strategy. Specifically, our research indicates the most effective and efficient way to learn secure coding is to fully understand coding errors before working on the source code. Our findings also suggest that we can use reading patterns to understand student behaviors in order to be capable of developing improved hands-on learning material.

关键词： Cybersecurity Cyber Threats Education coding Behavior Eye Tracking Software Vulnerabilities Cyber-Attacks secure coding

来源：评论

学校读者我要写书评

暂无评论

Awareness of secure coding Guidelines in the Industry - A first data analysis 19

Awareness of Secure Coding Guidelines in the Industry - A fi...

引用

19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (IEEE TrustCom)

作者： Gasiba, Tiago Espinha Lechner, Ulrike Pinto-Albuquerque, Maria Fernandez, Daniel Mendez Siemens AG Munich Germany Univ Bundeswehr Munchen Munich Germany Inst Univ Lisboa ISCTE IUL ISTAR IUL Lisbon Portugal Blekinge Inst Technol Karlskrona Sweden

ISBN: (纸本)9781665403924

Software needs to be secure, in particular, when deployed to critical infrastructures. secure coding guidelines capture practices in industrial software engineering to ensure the security of code. This study aims to assess the level of awareness of secure coding in industrial software engineering, the skills of software developers to spot weaknesses in software code, avoid them, and the organizational support to adhere to coding guidelines. The approach draws on well-established theories of policy compliance, neutralization theory, and security-related stress and the authors' many years of experience in industrial software engineering and on lessons identified from training secure coding in the industry. The paper presents the questionnaire design for the online survey and the first analysis of data from the pilot study.

关键词： Security secure coding Software Development Best Practices Security Awareness Industry

来源：评论

学校读者我要写书评

暂无评论

Design of secure coding Challenges for Cybersecurity Education in the Industry 13th

Design of Secure Coding Challenges for Cybersecurity Educati...

引用

13th International Conference on the Quality of Information and Communications Technology (QUATIC)

作者： Gasiba, Tiago Lechner, Ulrike Pinto-Albuquerque, Maria Zouitni, Alae Siemens AG Munich Germany Univ Bundeswehr Munchen Munich Germany ISTAR IUL Inst Univ Lisboa ISCTE IUL Lisbon Portugal Univ Passau Passau Germany

ISBN: (纸本)9783030587925;9783030587932

According to a recent survey with more than 4000 software developers, "less than half of developers can spot security holes". As a result, software products present a low-security quality expressed by vulnerabilities that can be exploited by cyber-criminals. This lack of quality and security is particularly dangerous if the software which contains the vulnerabilities is deployed in critical infrastructures. Serious games, and in particular, Capture-the-Flag (CTF) events, have shown promising results in improving secure coding awareness of software developers in the industry. The challenges in the CTF event, to be useful, must be adequately designed to address the target group. This paper presents novel contributions by investigating which challenge types are adequate to improve software developers' ability to write secure code in an industrial context. We propose 1) six challenge types usable in the industry context, and 2) a structure for the CTF challenges. Our investigation also presents results on 3) how to include hints and penalties into the cyber-security challenges. We evaluated our work through a survey with security experts. While our results show that "traditional" challenge types seem to be adequate, they also reveal a new class of challenges based on code entry and interaction with an automated coach.

关键词： Education Teaching Training secure coding Industry Cybersecurity Capture-the-flag Game analysis Game design Cybersecurity challenge

来源：评论

学校读者我要写书评

暂无评论

secure coding and Ethical Hacking Workshops with NAO for Engaging K-12 Female Students in CS 4

Secure Coding and Ethical Hacking Workshops with NAO for Eng...

引用

4th Conference on Research on Equity and Sustained Participation in Engineering, Computing, and Technology (RESPECT)

作者： Chattopadhyay, Ankur Grondahl, Kevin Ruckel, Jason Everson, Thomas Univ Wisconsin Comp Sci Green Bay WI 54302 USA

ISBN: (纸本)9781728108216

This research work is based upon the new Microsoft DigiSpark outreach project initiated by the computer science (CS) program at the University of Wisconsin - Green Bay (UWGB) in an effort to engage K-12 female learners in CS. It describes our unique experiential learning approach combining robotics and cybersecurity, which has been adopted in the outreach workshop sessions as part of our project. Our project involves the use of the NAO humanoid robots in order to successfully engage middle-school and high-school female students, who are underrepresented in CS. These outreach workshop sessions have exposed the young female participants to defensive computer programming, and computing security topics by providing them the hands-on opportunity to write secure code for programming the NAO, and to carry out an ethical hack on the NAO in order to explore robotic system vulnerabilities. Existing literature shows that there is limited work on the efficacy of teaching secure- coding and ethicalhacking related computer-security topics using a roboticplatform. Prior work indicate that a robotic-platform can be an effective and engaging medium for teaching computer-security. However, our proposed approach of teaching secure coding and ethical hacking through hands-on exercises with NAO is a firstof-its-kind experiment with female students at the K-12 level. As preliminary evidence of the effectiveness and potential of this novel approach, we discuss our preliminary experimental results, including initial participant interests and survey data, from the multiple NAO secure coding and NAO ethical hacking workshop sessions, which we have conducted with high-school and middle-school female learners.

关键词： NAO Humanoid Robot Computing Security Outreach Workshops secure coding Ethical Hacking K-12 Female Students Middle-School High-School

来源：评论

学校读者我要写书评

暂无评论

Towards the application of recommender systems to secure coding

引用

EURASIP JOURNAL ON INFORMATION SECURITY 2019年第1期2019卷 1-24页

作者： Nembhard, Fitzroy D. Carvalho, Marco M. Eskridge, Thomas C. Florida Inst Technol Coll Engn & Sci 150 W Univ Blvd Melbourne FL 32901 USA

secure coding is crucial for the design of secure and efficient software and computing systems. However, many programmers avoid secure coding practices for a variety of reasons. Some of these reasons are lack of knowledge of secure coding standards, negligence, and poor performance of and usability issues with existing code analysis tools. Therefore, it is essential to create tools that address these issues and concerns. This article features the proposal, development, and evaluation of a recommender system that uses text mining techniques, coupled with IntelliSense technology, to recommend fixes for potential vulnerabilities in program code. The resulting system mines a large code base of over 1.6 million Java files using the MapReduce methodology, creating a knowledge base for a recommender system that provides fixes for taint-style vulnerabilities. Formative testing and a usability study determined that surveyed participants strongly believed that a recommender system would help programmers write more secure code.

关键词： secure coding Vulnerability detection Code analysis Data mining secure systems Intellisense Big data Knowledge extraction Software engineering Cybersecurity

来源：评论

学校读者我要写书评

暂无评论

Raising secure coding Awareness for Software Developers in the Industry 27

Raising Secure Coding Awareness for Software Developers in t...

引用

IEEE 27th International Requirements Engineering Conference (REW)

作者： Gasiba, Tiago Lechner, Ulrike Siemens AG Munich Germany Univ Bundeswehr Munchen Munich Germany

ISBN: (纸本)9781728151656

Many industrial IT security standards and policies mandate the usage of a secure coding methodology in the software development process. This implies two different aspects: first, secure coding must be based on a set of secure coding guidelines, and second software developers must be aware of these secure coding practices. On the one side, secure coding guidelines seems a bit like a black-art: while there exist abstract guidelines that are widely accepted, low-level secure coding guidelines for different programming languages are scarce. On the other side, once a set of secure coding guidelines is chosen, a good methodology is needed to make them known by the people which should be using them, i.e. software developers. Motivated both by the secure coding requirements from industry standards and also by the mandate to train staff on IT security by the global industry initiative "Charter of Trust", this paper presents an overview of important research questions on how to choose secure coding guidelines and on how to raise software developer awareness for secure coding using serious games.

关键词： security policy secure coding guidelines IT security industry standard information systems industry serious games capture-the-flag

来源：评论

学校读者我要写书评

暂无评论

secure coding Practices in Java: Challenges and Vulnerabilities 18

Secure Coding Practices in Java: Challenges and Vulnerabilit...

引用

40th ACM/IEEE International Conference on Software Engineering (ICSE)

作者： Meng, Na Nagy, Stefan Yao, Danfeng (Daphne) Zhuang, Wenjie Argoty, Gustavo Arango Virginia Tech Dept Comp Sci Blacksburg VA 24061 USA

ISBN: (纸本)9781450356381

The Java platform and its third-party libraries provide useful features to facilitate secure coding. However, misusing them can cost developers time and effort, as well as introduce security vulnerabilities in software. We conducted an empirical study on StackOverflow posts, aiming to understand developers' concerns on Java secure coding, their programming obstacles, and insecure coding practices. We observed a wide adoption of the authentication and authorization features provided by Spring Security-a third-party framework designed to secure enterprise applications. We found that programming challenges are usually related to APIs or libraries, including the complicated cross-language data handling of cryptography APIs, and the complex Java-based or XML-based approaches to configure Spring Security. In addition, we reported multiple security vulnerabilities in the suggested code of accepted answers on the StackOverflow forum. The vulnerabilities included disabling the default protection against Cross-Site Request Forgery (CSRF) attacks, breaking SSL/TLS security through bypassing certificate validation, and using insecure cryptographic hash functions. Our findings reveal the insufficiency of secure coding assistance and documentation, as well as the huge gap between security theory and coding practices.

关键词： secure coding Spring Security CSRF SSL/TLS certificate validation cryptographic hash functions authentication authorization StackOverflow cryptography

来源：评论

学校读者我要写书评

暂无评论

Introducing secure coding in Undergraduate (CS0, CS1, and CS2) and High School (AP Computer Science A) Programming Courses 18

Introducing Secure Coding in Undergraduate (CS0, CS1, and CS...

引用

49th ACM SIGCSE Technical Symposium on Computer Science Education (SIGCSE)

作者： Kozo, Siddharth Taylor, Blair Towson Univ Towson MD USA

ISBN: (纸本)9781450351034

The ACM CS 2013 curriculum includes Information Assurance and Security as a pervasive knowledge area, the ACM Community College curricular guidelines, CSTransfer2017, places great emphasis on cybersecurity as well. However, introducing security in introductory programming courses is challenging because of lack of appropriate teaching resources and training. This workshop will provide a well-tested strategy for introducing secure coding concepts in CS0, CS1, CS2, and AP CS A classes. We will introduce attendees to secure coding through hands-on exercises, and provide self-contained, lab-based modules designed to be injected into CS0-CS2 with minimal impact on the course (***/securityinjections). Participants will be encouraged to bring in their own syllabus and labs to modify to include learning objectives focused on cybersecurity based on ACM and CAE guidelines. Laptop recommended.

关键词： Security Injections Cybersecurity CS1 High School secure coding

来源：评论

学校读者我要写书评

暂无评论

Employing secure coding practices into industrial applications: a case study

引用

EMPIRICAL SOFTWARE ENGINEERING 2016年第1期21卷 4-16页

作者： Khalili, Abdullah Sami, Ashkan Azimi, Mahdi Moshtari, Sara Salehi, Zahra Ghiasi, Mahboobe Safavi, Ali Akbar Shiraz Univ Sch Elect & Comp Engn CSE & IT Dept Shiraz Iran Shiraz Univ Sch Elect & Comp Engn Power & Control Engn Dept Shiraz Iran

Industrial Control Systems (ICS) are the vital part of modern critical infrastructures. Recent attacks to ICS indicate that these systems have various types of vulnerabilities. A large number of vulnerabilities are due to secure coding problems in industrial applications. Several international and national organizations like: NIST, DHS, and US-CERT have provided extensive documentation on securing ICS;however proper details on securing software application for industrial setting were not presented. The notable point that makes securing a difficult task is the contradictions between security priorities in ICS and IT systems. In addition, none of the guidelines highlights the implications on modification of general IT security solutions to industrial settings. Moreover based on the best of our knowledge, steps to develop a successful real-world secure industrial application have not been reported. In this paper, the first attempts to employ secure coding best practices into a real world industrial application (Supervisory Control and Data Acquisition) called OpenSCADA is presented. Experiments indicate that resolving the vulnerabilities of OpenSCADA in addition to possible improvement in its availability, does not jeopardize other dimensions of security. In addition, all experiments are backed up with proper statistical tests to see whether or not, improvements are statistically significant.

关键词： Industrial control system SCADA secure coding Memory leak Availability Time critical process

来源：评论

学校读者我要写书评

暂无评论

Security Injections@Towson: Integrating secure coding into Introductory Computer Science Courses

引用

ACM TRANSACTIONS ON COMPUTING EDUCATION 2016年第4期16卷 16-16页

作者： Taylor, Blair Kaza, Siddharth Towson Univ Towson MD USA Dept Comp & Informat Sci 7800 York Rd Towson MD 21252 USA

Despite the critical societal importance of computer security, security is not well integrated into the undergraduate computing curriculum. Security classes and tracks treat security issues as separable topics as opposed to fundamental issues that pervade all aspects of software development. Recently, there has been an increasing focus on security as a cross-cutting concern across the computer science curriculum. The Security Injections@Towson project provides resources and effective strategies to incorporate secure coding in the early programming classes. We describe the development, assessment, and dissemination of more than 40 lab-based security injection modules designed to be injected into courses with minimal impact on the curriculum. We include assessment results from 1,135 students across five diverse institutions demonstrating that the security injections help students retain, comprehend, and apply secure coding concepts in the introductory programming courses.

关键词： Security Security injections secure coding CS0 CS1 CS2 security integration

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：