2021/03/08 by Sarah Elder, Elder, Sarah, Nusrat Zahan +9 · 1 citation
Computer Science · #Cryptography and Security (cs.CR) #D.2.0 #FOS: Computer and information sciences #Information and Cyber Security #K.3.0 #K.6.5 #Software Engineering (cs.SE) #Software Reliability and Analysis Research #Web Application Security Vulnerabilities
paper · pdf · doi:10.48550/arxiv.2103.05088
openalex publication_date 2021/03/08 · openalex created_date 2022/07/25 · openalex updated_date 2026/07/28
Lack of security expertise among software practitioners is a problem with\nmany implications. First, there is a deficit of security professionals to meet\ncurrent needs. Additionally, even practitioners who do not plan to work in\nsecurity may benefit from increased understanding of security. The goal of this\npaper is to aid software engineering educators in designing a comprehensive\nsoftware security course by sharing an experience running a software security\ncourse for the eleventh time. Through all the eleven years of running the\nsoftware security course, the course objectives have been comprehensive -\nranging from security testing, to secure design and coding, to security\nrequirements to security risk management. For the first time in this eleventh\nyear, a theme of the course assignments was to map vulnerability discovery to\nthe security controls of the Open Web Application Security Project (OWASP)\nApplication Security Verification Standard (ASVS). Based upon student\nperformance on a final exploratory penetration testing project, this mapping\nmay have increased students' depth of understanding of a wider range of\nsecurity topics. The students efficiently detected 191 unique and verified\nvulnerabilities of 28 different Common Weakness Enumeration (CWE) types during\na three-hour period in the OpenMRS project, an electronic health record\napplication in active use.\n