Comparing Educational Approaches to Secure programming: Tool vs. TA

The cause of many security problems is vulnerabilities in the underlying code. These vulnerabilities are the result of security mistakes made by programmers during application development, often because of lack of knowledge of the security implications of their code. Thus, educators need to teach students as future developers not only how to program, but how to program securely. Many researchers advocate integrating secure programming guidelines across the computer science curriculum. We are exploring a tool to support this goal. ESIDE (Educational Security in the IDE) is an Eclipse plug-in for Java which provides instant security warnings, detailed explanations, and auto-generated remediation code. The goal is to provide contextualized awareness and knowledge of security vulnerabilities and mitigations as students work on programming assignments within any course. In our latest study, we compare our tool against an alternative approach of using security clinics, a one-on-one session with a teaching assistant. We report preliminary findings regarding strengths and weaknesses of our tool based approach to train developers.