Software Reengineering Based Security Teaching

The problem of developing secure code is well known to high-tech sector companies. Some, like Microsoft, have found it necessary to establish ongoing security training for their developers to make up for the absence of college-level, secure coding curriculum. This research takes a unique, software reengineering-based, thread approach. Curriculum modules are built around a concept such as input data validation, encapsulation, errors, etc. A software engineering case study is developed for each module that will produce code the traditional way, without regard to security, then re-engineer the code to transform it to include security concepts. Going through the cases in this manner, will give attending faculty, not only specific labs they can implement in their own courses, but also an understanding of how to transform their own existing assignments to incorporate secure coding practices.