<p>I would have a "guest lecturer" who was a cybersecurity professional teach one class. (Maybe I would give a test on the lecture the following day.)</p>

<p>Most CS instructors are aware of security problems connected with software, but not all of them understand the hardware issues. Unless you happen to have a professional cybersecurity background, you may be better off "farming out" that one session to someone that does. In such matters, you want to present an integrated view, or at least one that is as fully integrated as you can make it.</p>

CC BY-SA 3.0
2017-06-12T00:28:41.780Z
2017-06-12T00:28:41.780Z
Tom Au
<p>Make it into an assignment/game. Each student creates a project that is passed to another, randomly chosen student, to hack. Give points for both the project and the "hacking" results. The hacking assignment should also be graded.</p>

<p>Security has to be taught and the value learned, usually painfully. I have lived through many "no one will do that!" only to have a product, or network, broken because someone did.</p>

CC BY-SA 3.0
2017-05-24T07:50:42.143Z
If someone finds a flaw in your app, you lose 1 credit. Who finds it first gets 1 extra credit. Let the games begin!
ecc
CC BY-SA 3.0
2017-05-24T11:10:15.097Z
How would I handle the case when there are no flaws in the code? You can't assign points for flaws that don't exist. So you'd have to require the students to explain why there is no flaw?
Floern
CC BY-SA 3.0
2017-05-24T12:07:01.223Z
Explain or defend, yes. Then the project becomes "how did you prove there are now flaws". You could also give the class a program with known flaws and have them attack that.
AlG
CC BY-SA 3.0
2017-05-25T11:41:27.863Z
@Keelan I disagree.  For example in a C class, code that could have buffer overflows should lose points.
Eric Johnson
CC BY-SA 3.0
2017-05-23T19:02:56.920Z
2017-05-23T19:02:56.920Z
AlG
<p>As mentioned in other answer making education like a game is good idea. </p>

<p>You can use SQL Injection as one of the examples, other like password to be word from the web page itself, other can be default username/passwords like root/root, admin/admin and so on. During the class you mention this keyword (SQL for example) and give them as home work URL to dig.</p>

<p>Further you can create teams which can try to work together on specific challenge. Also those teams can create some site, program, etc and give to other team as challenge to hack.</p>

CC BY-SA 3.0
2017-05-24T06:47:30.223Z
2017-05-24T06:47:30.223Z
Romeo Ninov
<p>Security vulnerabilities are just bugs. In your example the code does not do what it is supposed to do (keep the bad people out).</p>

<p>So treat them this way. “We have a bug. The program does not meet its security requirement of …”.</p>

<p>The worse thing we can do (and I have seen this in classes), is to demonstrate bad code, unless it is part of a “What is wrong with this?”. I have seen a teacher present this as an example of how to do things (a lesson on selection).</p>

<pre><code>if entered_password == "fred1234":
    print ("welcome")
</code></pre>

<p>I have heard the argument that doing this properly would be do difficult for a beginner class. I agree. I would not try to fix this program. I would just present a different program.</p>

<p>I have seen a lot of bad practice taught, that then needs to be untaught latter on. When I was a software engineer, it was often me un-teaching new recruits. This was not easy when they were not good at critical thinking, and saw what they were taught as <em>truth</em>. </p>

CC BY-SA 3.0
2017-08-02T11:22:14.053Z
2017-08-02T11:22:14.053Z
ctrl-alt-delor
<p>I would just try to make resources available to them and make sure to give examples of what not to do (e.g. Your example). In terms of resources, I'd provide info about attack vectors, threat models, etc. Specifically I'd provide the OWASP top 10.</p>

CC BY-SA 3.0
2017-05-23T19:54:05.067Z
2017-05-23T19:54:05.067Z
thesecretmaster
<p>Emphasize the 'stupidity' of security holes - they aren't weaknesses that only geniuses with a bone to pick can root out, they're the same mistakes repeated <em>ad nauseam</em> between different companies, therefore every application is liable to run into them.
Using the CWSS (common weakness scoring system) the highest priority vulnerabilities are SQL Injection, OS Command Injection and classic buffer overflow. <a href="https://cwe.mitre.org/top25/#cwe-89" rel="nofollow noreferrer">(full list)</a></p>

<p>As other answers have said, a game is the best approach; preferably a readymade "Please hack me" style website for them to attack.</p>

<p><a href="http://hackyourselffirst.troyhunt.com" rel="nofollow noreferrer">Example</a></p>

CC BY-SA 3.0
2017-08-10T16:23:22.380Z
Welcome to Computer Science Educators! Whilst this may theoretically answer the question, [it would be preferable](https://meta.stackexchange.com/questions/8231/are-answers-that-just-contain-links-elsewhere-really-good-answers/8259#8259) to include the essential parts of the answer here, and provide the link for reference.
ItamarG3
CC BY-SA 3.0
2017-08-10T16:22:12.690Z
2017-08-10T16:32:56.337Z
2017-08-10T16:32:56.337Z
jMan
<p>My first website with a login form had the password hardcoded in the JavaScript code, and if the entered password matched it would redirect to a private URL that was just not linked anywhere, but still public if anyone knew the URL, and yes, that URL was also hardcoded in the JavaScript code.</p>

<p>So in terms of security this was basically a "Do not read" banner, with the "private" content just written below it.</p>

<p>Now, this is just a specific example of me not knowing any better in the early days of web development. There are many other domains in programming where you might introduce vulnerabilities if you don't think about what you're doing.</p>

<p>Is there a generic technique to teach students to keep an eye on their code's security, maybe trying to get them into figuratively hacking their own programs and exploit vulnerabilities?</p>

CC BY-SA 3.0
2017-05-24T11:14:39.660Z
I was thinking about beginners here. I know there are CS master's courses that explicitly focus on detecting vulnerabilities (network security, for example).
Floern
<web-development><security>
How to raise students' security awareness in programming?
# How to raise students' security awareness in programming?

(Asked by: username_0 on 2017-05-23)

My first website with a login form had the password hardcoded in the JavaScript code, and if the entered password matched it would redirect to a private URL that was just not linked anywhere, but still public if anyone knew the URL, and yes, that URL was also hardcoded in the JavaScript code.

So in terms of security this was basically a "Do not read" banner, with the "private" content just written below it.

Now, this is just a specific example of me not knowing any better in the early days of web development. There are many other domains in programming where you might introduce vulnerabilities if you don't think about what you're doing.

Is there a generic technique to teach students to keep an eye on their code's security, maybe trying to get them into figuratively hacking their own programs and exploit vulnerabilities?

**Tags:** web-development, security

> **Comments:**
> **username_0**: I was thinking about beginners here. I know there are CS master's courses that explicitly focus on detecting vulnerabilities (network security, for example).  

---

## 6 answers

### Answer by username_2 on 2017-05-23. Score: 14

Make it into an assignment/game. Each student creates a project that is passed to another, randomly chosen student, to hack. Give points for both the project and the "hacking" results. The hacking assignment should also be graded.

Security has to be taught and the value learned, usually painfully. I have lived through many "no one will do that!" only to have a product, or network, broken because someone did.

> **Comments:**
> **username_3**: If someone finds a flaw in your app, you lose 1 credit. Who finds it first gets 1 extra credit. Let the games begin!  
> **username_0**: How would I handle the case when there are no flaws in the code? You can't assign points for flaws that don't exist. So you'd have to require the students to explain why there is no flaw?  
> **username_2**: Explain or defend, yes. Then the project becomes "how did you prove there are now flaws". You could also give the class a program with known flaws and have them attack that.  
> **username_4**: @Keelan I disagree.  For example in a C class, code that could have buffer overflows should lose points.  

---

### Answer by username_5 on 2017-05-24. Score: 4

As mentioned in other answer making education like a game is good idea.

You can use SQL Injection as one of the examples, other like password to be word from the web page itself, other can be default username/passwords like root/root, admin/admin and so on. During the class you mention this keyword (SQL for example) and give them as home work URL to dig.

Further you can create teams which can try to work together on specific challenge. Also those teams can create some site, program, etc and give to other team as challenge to hack.


---

### Answer by username_6 on 2017-08-02. Score: 2

Security vulnerabilities are just bugs. In your example the code does not do what it is supposed to do (keep the bad people out).
So treat them this way. “We have a bug. The program does not meet its security requirement of …”.
The worse thing we can do (and I have seen this in classes), is to demonstrate bad code, unless it is part of a “What is wrong with this?”. I have seen a teacher present this as an example of how to do things (a lesson on selection).
if entered_password == "fred1234":
    print ("welcome")

I have heard the argument that doing this properly would be do difficult for a beginner class. I agree. I would not try to fix this program. I would just present a different program.
I have seen a lot of bad practice taught, that then needs to be untaught latter on. When I was a software engineer, it was often me un-teaching new recruits. This was not easy when they were not good at critical thinking, and saw what they were taught as truth.


---

### Answer by username_7 on 2017-05-23. Score: 2

I would just try to make resources available to them and make sure to give examples of what not to do (e.g. Your example). In terms of resources, I'd provide info about attack vectors, threat models, etc. Specifically I'd provide the OWASP top 10.


---

### Answer by username_8 on 2017-08-10. Score: 2

Emphasize the 'stupidity' of security holes - they aren't weaknesses that only geniuses with a bone to pick can root out, they're the same mistakes repeated *ad nauseam* between different companies, therefore every application is liable to run into them.
Using the CWSS (common weakness scoring system) the highest priority vulnerabilities are SQL Injection, OS Command Injection and classic buffer overflow. [(full list)](https://cwe.mitre.org/top25/#cwe-89)

As other answers have said, a game is the best approach; preferably a readymade "Please hack me" style website for them to attack.

[Example](http://hackyourselffirst.troyhunt.com)

> **Comments:**
> **username_9**: Welcome to Computer Science Educators! Whilst this may theoretically answer the question, [it would be preferable](https://meta.stackexchange.com/questions/8231/are-answers-that-just-contain-links-elsewhere-really-good-answers/8259#8259) to include the essential parts of the answer here, and provide the link for reference.  

---

### Answer by username_1 on 2017-06-12. Score: 1

I would have a "guest lecturer" who was a cybersecurity professional teach one class. (Maybe I would give a test on the lecture the following day.)

Most CS instructors are aware of security problems connected with software, but not all of them understand the hardware issues. Unless you happen to have a professional cybersecurity background, you may be better off "farming out" that one session to someone that does. In such matters, you want to present an integrated view, or at least one that is as fully integrated as you can make it.


---

