ERIC Number: EJ1343162
Record Type: Journal
Publication Date: 2020-Jun
Pages: 28
Abstractor: As Provided
ISBN: N/A
ISSN: EISSN-2472-2707
EISSN: N/A
Evaluating and Securing Text-Based Java Code through Static Code Analysis
Yang, Jeong; Lee, Young; Fernandez, Amanda; Sanchez, Joshua
Journal of Cybersecurity Education, Research and Practice, v2020 n1 Article 3 Jun 2020
As the cyber security landscape dynamically evolves and security professionals work to keep apace, modern-day educators face the issue of equipping a new generation for this dynamic landscape. With cyber-attacks and vulnerabilities substantially increased over the past years in frequency and severity, it is important to design and build secure software applications from the group up. Therefore, defensive secure coding techniques covering security concepts must be taught from beginning computer science programming courses to exercise building secure applications. Using static analysis, this study thoroughly analyzed Java source code in two textbooks used at a collegiate level, with the goal of guiding educators to make a reference of the resources in teaching programming concepts from a security perspective. The resources include the methods of source code analysis and relevant tools, categorized bugs detected in the code, and compliant code examples with fixing the bugs. Overall, the first text revealed a relatively moderate bug rate of approximately 44% of files analyzed contained either regular or security bugs. About 13% of the total bugs found were security bugs and the most common security bug was related to the Pseudo Random security vulnerability. The second text produced a slightly larger bug rate of 53.80% with approximately 8% of security bugs. After combining the texts for an average rate, the total number of security bugs that were likely to appear was roughly 10% percent. This encompasses security bugs such as malicious code vulnerabilities and security vulnerabilities related to exposing or manipulating data in these programs.
Descriptors: Computer Security, Programming Languages, Programming, Computer Uses in Education, Technology Uses in Education, Error Patterns, Computer Science Education, Data Analysis, Textbooks, Electronic Publishing, Coding
Kennesaw State University. 1000 Chastain Road, Kennesaw, Georgia 30144. Tel: 470-578-3568; e-mail: cybersec@kennesaw.edu; Web site: https://digitalcommons.kennesaw.edu/jcerp/
Publication Type: Journal Articles; Reports - Research
Education Level: N/A
Audience: N/A
Language: English
Sponsor: N/A
Authoring Institution: N/A
Grant or Contract Numbers: N/A