Design of Secure Coding Challenges for Cybersecurity Education in the Industry

Abstract

According to a recent survey with more than 4000 software developers, "less than half of developers can spot security holes". As a result, software products present a low-security quality expressed by vulnerabilities that can be exploited by cyber-criminals. This lack of quality and security is particularly dangerous if the software which contains the vulnerabilities is deployed in critical infrastructures. Serious games, and in particular, Capture-the-Flag(CTF) events, have shown promising results in improving secure coding awareness of software developers in the industry. The challenges in the CTF event, to be useful, must be adequately designed to address the target group. This paper presents novel contributions by investigating which challenge types are adequate to improve software developers' ability to write secure code in an industrial context. We propose 1) six challenge types usable in the industry context, and 2) a structure for the CTF challenges. Our investigation also presents results on 3) how to include hints and penalties into the cyber-security challenges. We evaluated our work through a survey with security experts. While our results show that "traditional" challenge types seem to be adequate, they also reveal a new class of challenges based on code entry and interaction with an automated coach.this stage, several hints can be given to the player depending on several factors, e.g., time taken by the player to solve the challenge or the previous number of attempts to solve the challenge. The logic stage is responsible for evaluating the solution to the challenge provided by the player and determining if it is correct (acceptable) or wrong (not acceptable). According to the analysis of the answer provided by the player, points or penalties might be awarded.

CyberSecurity Challenges for Software Developer Awareness Training in Industrial Environments

“…i.e., code that is free from known vulnerabilities and adheres to secure coding policies. Previous work introduced the CyberSecurity Challenges from a theoretical point-of-view [11,16] and focused on particular aspects [15]. The current work extends previous publications by a presentation of a unified view on the design process, tailoring to the industry's needs and the perceived usefulness of the CSC events.…”

“…The present work uses serious games to achieve the goal of raising secure coding awareness of software developers in the industry. Previous work on selected design aspects and a smaller empirical basis on the CSC includes [11][12][13][14][15][16][17].…”

Cybersecurity Awareness Platform with Virtual Coach and Automated Challenge Assessment

“…In [6], Gasiba et al study the requirements that a game designer should follow in order to target the game to software developers in the industry. In a further work [8], the authors provide six concrete and different challenge types to be used in this kind of CTF event. One of these is the "code entry" challenge type, where the proposed idea is that player interacts through a web interface with a back-end by modifying vulnerable code until all the coding guidelines are fulfilled, thus solving the challenge.…”

“…Gasiba et. al [8] propose, in a similar work, six different challenge types. These challenges, which are also a form of programming exercises, are executed in the context of a serious game of the type CTF and target software developers in the industry.…”

“…In [8], the authors present a type of challenge for CTFs in the industry which is called code-entry challenge (CEC). The main idea of this type of challenge, is for the Player to be given a software development project that contains code that does not follow secure coding guidelines (SCG) and secure software development best practices (BP) and also contains security vulnerabilities.…”