# How to raise students' security awareness in programming?

My first website with a login form had the password hardcoded in the JavaScript code, and if the entered password matched it would redirect to a private URL that was just not linked anywhere, but still public if anyone knew the URL, and yes, that URL was also hardcoded in the JavaScript code.

So in terms of security this was basically a "Do not read" banner, with the "private" content just written below it.

Now, this is just a specific example of me not knowing any better in the early days of web development. There are many other domains in programming where you might introduce vulnerabilities if you don't think about what you're doing.

Is there a generic technique to teach students to keep an eye on their code's security, maybe trying to get them into figuratively hacking their own programs and exploit vulnerabilities?

• Is this really something you want to incorporate into programming courses? In my experience, courses work better when they focus on one, or a few closely related topics. So, I'd suggest a separate security course in the curriculum. – user24 May 23 '17 at 19:05
• I was thinking about beginners here. I know there are CS master's courses that explicitly focus on detecting vulnerabilities (network security, for example). – Floern May 24 '17 at 11:14

Make it into an assignment/game. Each student creates a project that is passed to another, randomly chosen student, to hack. Give points for both the project and the "hacking" results. The hacking assignment should also be graded.

Security has to be taught and the value learned, usually painfully. I have lived through many "no one will do that!" only to have a product, or network, broken because someone did.

• If someone finds a flaw in your app, you lose 1 credit. Who finds it first gets 1 extra credit. Let the games begin! – ecc May 24 '17 at 7:50
• How would I handle the case when there are no flaws in the code? You can't assign points for flaws that don't exist. So you'd have to require the students to explain why there is no flaw? – Floern May 24 '17 at 11:10
• Explain or defend, yes. Then the project becomes "how did you prove there are now flaws". You could also give the class a program with known flaws and have them attack that. – AlG May 24 '17 at 12:07
• @ecc When the course objective is not related to security, it is inappropriate to deduct points for security flaws. – user24 May 24 '17 at 12:09
• @EricJohnson that depends. If the course objective is to implement algorithms, it is not really relevant. As a rule of thumb, I would say don't grade what you don't teach. – user24 May 25 '17 at 11:43

As mentioned in other answer making education like a game is good idea.

You can use SQL Injection as one of the examples, other like password to be word from the web page itself, other can be default username/passwords like root/root, admin/admin and so on. During the class you mention this keyword (SQL for example) and give them as home work URL to dig.

Further you can create teams which can try to work together on specific challenge. Also those teams can create some site, program, etc and give to other team as challenge to hack.

I would just try to make resources available to them and make sure to give examples of what not to do (e.g. Your example). In terms of resources, I'd provide info about attack vectors, threat models, etc. Specifically I'd provide the OWASP top 10.

Security vulnerabilities are just bugs. In your example the code does not do what it is supposed to do (keep the bad people out).

So treat them this way. “We have a bug. The program does not meet its security requirement of …”.

The worse thing we can do (and I have seen this in classes), is to demonstrate bad code, unless it is part of a “What is wrong with this?”. I have seen a teacher present this as an example of how to do things (a lesson on selection).

if entered_password == "fred1234":
print ("welcome")


I have heard the argument that doing this properly would be do difficult for a beginner class. I agree. I would not try to fix this program. I would just present a different program.

I have seen a lot of bad practice taught, that then needs to be untaught latter on. When I was a software engineer, it was often me un-teaching new recruits. This was not easy when they were not good at critical thinking, and saw what they were taught as truth.

Emphasize the 'stupidity' of security holes - they aren't weaknesses that only geniuses with a bone to pick can root out, they're the same mistakes repeated ad nauseam between different companies, therefore every application is liable to run into them. Using the CWSS (common weakness scoring system) the highest priority vulnerabilities are SQL Injection, OS Command Injection and classic buffer overflow. (full list)

As other answers have said, a game is the best approach; preferably a readymade "Please hack me" style website for them to attack.

Example

• Welcome to Computer Science Educators! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – ItamarG3 Aug 10 '17 at 16:23

I would have a "guest lecturer" who was a cybersecurity professional teach one class. (Maybe I would give a test on the lecture the following day.)

Most CS instructors are aware of security problems connected with software, but not all of them understand the hardware issues. Unless you happen to have a professional cybersecurity background, you may be better off "farming out" that one session to someone that does. In such matters, you want to present an integrated view, or at least one that is as fully integrated as you can make it.