Structuring a Comprehensive Software Security Course Around the OWASP Application Security Verification Standard

Abstract

Lack of security expertise among software practitioners is a problem with many implications. First, there is a deficit of security professionals to meet current needs. Additionally, even practitioners who do not plan to work in security may benefit from increased understanding of security. The goal of this paper is to aid software engineering educators in designing a comprehensive software security course by sharing an experience running a software security course for the eleventh time.Through all the eleven years of running the software security course, the course objectives have been comprehensive -ranging from security testing, to secure design and coding, to security requirements to security risk management. For the first time in this eleventh year, a theme of the course assignments was to map vulnerability discovery to the security controls of the Open Web Application Security Project (OWASP) Application Security Verification Standard (ASVS). Based upon student performance on a final exploratory penetration testing project, this mapping may have increased students' depth of understanding of a wider range of security topics. The students efficiently detected 191 unique and verified vulnerabilities of 28 different Common Weakness Enumeration (CWE) types during a three-hour period in the OpenMRS project, an electronic health record application in active use.

Do I really need all this work to find vulnerabilities? An empirical case study comparing vulnerability detection techniques on a Java application

“…Collecting data for this study required a team of four graduate students a combined eleven months of full-time work and twenty months of part-time work; four months part-time work from an undergraduate student; and the results of assignments from a large graduate-level software security course. Our experiences in structuring the software security course have been reported previously in Elder et al [26].…”

Software security models and frameworks: an overview and current trends

“…According to [98], some of the software security maturity models include Open Web Application Security Project (OWASP)'s Software Assurance Maturity Model (OpenSAMM), Building Security In Maturity Model (BSIMM) and BSIMM for vendors (vBSIMM). However, these security-specific maturity models and their checklists are not adequate in all contexts [99].…”