Security Injections 2.0

Student skipping content is common in traditional learning modules that present a large amount of content in a linear format. This can lead to lower student engagement, and may yield poor learning. In this paper, we compare student learning between enhanced learning modules (2.0) and traditional modules (1.0) aimed at providing knowledge on secure coding to students in lower-level programming courses. We discuss the results of a quasi-experiment across two sections of CS0. The study compares students' secure coding awareness, general software security awareness and students' ability to identify security vulnerabilities (integer overflow, input validation and buffer overflow) in three separate code segments. A total of 53 students participated in the study. While results indicate significant improvement in secure coding and general software security awareness in both 1.0 and 2.0 modules, students using 2.0 modules performed significantly better than students using 1.0 modules in applying secure coding knowledge by identifying security vulnerabilities in code segments.