This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic programming concepts from scratch. She is at the top of her class in each of her college courses, producing high quality work, and she has attracted so much attention that she is already getting contract work. 

As ITSec pros, we talk about infusing the development cycle with secure coding practices and design, but how does that apply to a brand-new learner? A new programmer is at the start of their own 'lifelong development cycle', at it were. At what point is it appropriate, from an educational perspective, to switch from the mindset of 'getting it to work' to 'it absolutely must be secure'? At what point should a student 'fail' an assignment because of a security issue?

She completely understands the need to produce secure code, and wants to, but none of her classes have introduced the idea and keeps coming to me for code review and analysis. When should the switch be made to force her to re-design all the class assignments to use secure design?

I don't want to cut a promising career short by introducing frustrating requirements, but I also want to give that new career the best possible start. In addition, are there resources to help me teach her the basics of secure coding from a beginning programmer's perspective? I find that I'm making it up as I go...

I welcome your advice.


At what point is it appropriate, from an educational perspective, to switch from the mindset of 'getting it to work' to 'it absolutely must be secure'? 
At what point should a student 'fail' an assignment because of a security issue?
When should the switch be made to force her to re-design all the class assignments to use secure design?
Are there resources to help me teach her the basics of secure coding from a beginning programmer's perspective?




As a side note: I have noticed that by raising the bar in my code review of her class assignments, just in terms of basic 'validate and sanitize' security, she has ended up producing very high quality code in general. From this one example, I think I can see the value of starting one's education this way because it forces an even deeper understanding of data flow and programming logic.

I would say a great way to learn is for her to break the applications she has already written.

Assuming she is writing web applications, point her towards the OWASP Top 10. Have her see if she can find any of those flaws in her own code. There is no better way to learn about security concepts than actually seeing it happen on your own code.

Once a flaw has been found, have her rewrite the application to fix the flaw. Doing so will allow her to appreciate the effect of things like sanitation and validation of user inputs and parameterized queries.

Take incremental steps. I wouldn't jump straight into designing a new application with security in mind before truly understanding what type of codes result in security flaws. 
