Beware of input buffer misbehavior and make your code behave: a nifty hands-on assignment on secure coding at the CS0 and CS1 levels: nifty assignment
Ankur Chattopadhyay · Journal of computing sciences in colleges · 2015
The latest ACM/IEEE computing curriculum (the CS2013 Final Report) has emphasized a strong need for inclusion of security topics within the current body of knowledge in computing education. These recent curricular recommendations lead to a more security focused computing curriculum, which requires relevant security topics to be incorporated in fundamental computing courses at the freshman and sophomore levels. To address this requirement, a nifty assignment on secure coding, which can be used in both CS0 and CS1 classes, is presented in this work. This hands-on exercise focuses on how to use defensive programming techniques/skills for protecting software code from buffer vulnerabilities arising from specific in-built library modules. Buffer vulnerabilities cause software security problems and lead to code misbehavior along with potential buffer attacks. Some instances of such input buffer vulnerabilities in a standard high-level programming language like C/C++ are introduced and demonstrated by this assignment. It highlights the aspect of intrinsic library limitations while programming, makes students aware of those limitations and teaches them how to overcome them. Overall, this assignment is a practical computing exercise based on the topic of inherent buffer flaws and its non-conventional approach is different from the traditional secure programming assignments, which use buffer overflow. The assignment was developed with simplified step wise instructions so that it is easily accessible to freshman and sophomore learners at the CS0 & CS1 levels. It was created as part of the 'Build-A-Lab' program under the NSF project of 'Security Injections' at Towson University, Maryland. It has been implemented as a lab module under the topic of software security and has been successfully deployed in computing classes like Essentials of Information Technology (IT), Fundamentals of Programming, Computer Security and Information Assurance & Security.