Creating Defensive Programmers : Evaluating the Impact of Adding Cybesecurity Topics to Core Computer Science Courses

The research described in this summary explores whether adding defensive programming topics to the Computer Science (CS) curriculum produces graduates who understand and appreciate the risks associated with software vulnerabilities, and who create software free of common vulnerabilities. Defensive programming lectures and assignments have been developed and added to core CS courses. The assignments teach how common vulnerabilities are exploited and how the vulnerabilities can be mitigated. To explore whether these assignments enhance the students’ knowledge and practice, several forms of data collection are done. Students will be required to static test code for class projects for vulnerabilities. Data on the number and type of vulnerabilities will be collected. The trends in the number and types of vulnerabilities over three semesters will give insight into whether the addition of defensive programming topics results in students creating software with fewer vulnerabilities. A survey with multiple choice questions on cybersecurity topics, and free response questions on interest and relevance of cybersecurity will also be given to students in four different core CS courses over three semesters. A multiple linear regression analysis will be performed to determine how survey scores are affected by a student’s progress in the curriculum. The change in regression coefficients will give insight into whether adding defensive programming topics throughout the curriculum is having the desired effect and producing graduates who with a greater understanding of defensive programming. NLP analysis of responses to reflection prompts and free response survey question will give insight into students’ attitude toward defensive programming, and whether they appreciate the need to incorporate defensive programming habits.