What topics should or should not be included in software security education—Qualitative content analysis

Abstract

Software security education is still not preparing students for the types of high‐skilled technical roles that represent the most severe workforce shortage. Recognizing this, academia has begun redefining the knowledge area concepts of software security curricula to meet the current workforce shortage. This article studies the software security courses in Arab Gulf academic programs and benchmarks their descriptions with the corresponding knowledge area from cybersecurity Curricula (CSEC). 2017, the first set of global cybersecurity curricular guidelines. Using content analysis, six concepts or essentials are investigated: security requirements, secure design principles, secure source code, analysis and testing, patch, and ethics. It was found that no course follows all the CSEC. 2017 essentials. The analysis and testing essential were considered by all courses, and security after deployment, including the patch essential, needs more attention because it was not included in any course. Similarly, the security requirements and ethics essentials were also considered by a few courses. However, software success depends on requirements, and ethics has become critical in the cybersecurity and information assurance fields that depend on law and forensics. The secure source code essential was covered by most courses. The well‐known types of code attacks were covered, and over half of the courses discussed secure design principles essential. However, security by design is an emerging development philosophy. The article discussed observations and recommendations that will assist program managers and their staff in making effective decisions about the essentials and concepts that should be included when they are developing the software security curriculum.

A Quadruple “E” Approach for Effective Cyber-Hygiene Behaviour and Attitude toward Online Learning among Higher-Education Students in Saudi Arabia amid COVID-19 Pandemic

“…In India, the study by Rathod [22] indicated a practical need to heighten personal cybersecurity among higher-education students who constantly use distance education through the diversity of cyber-hygiene knowledge, awareness, and behaviours. In UAE, implementing the approaches of cyber-hygiene awareness concern applied as a holistic approach in higher education is critical to affecting online learning practices amid COVID-19 [40]. Other articles from the Arab Region empirically examined cyber-hygiene culture and awareness among students in higher-education organisations that were found to have a lack of cyber-hygiene cognition, knowledge, and skills [41,42].…”

Exploring How to Apply Secure Software Design Principles

“…Although software security is an aspect of quality assurance for all types of software [1], users are still struggling to maintain their information. Regrettably, thousands of software designers and developers are less experienced in security skills as these were not part of their curriculum at university [2]. Different security techniques have been proposed to be applied in each software development life cycle (SDLC) phase, comprising requirements, design, coding, and testing.…”

“…Different security techniques have been proposed to be applied in each software development life cycle (SDLC) phase, comprising requirements, design, coding, and testing. However, 32% of research work in the existing literature focused on techniques solely in the design stage [2]. This is because the vulnerabilities of design are the major source of security risk in software systems, and 50% of software errors are often identified in the design stage [3].…”

“…The developers and designers rely on searching the internet and browsing e-books whenever they face security issues [7]. Trying to address this deficit early on, researchers have recommended including SDPs in software security-related education; rather than focusing on particular technologies, education should focus on understanding principles that can be abstracted and applied to several situations across various systems [2]. This paper attempts to fill this gap by learning by example, explaining how developers can apply SDPs via a real-world software project-electronic promotion system (ePS)-with the aim of improving software engineers' knowledge to prevent security violations in their systems.…”

Exploring Android Obfuscators and Deobfuscators: An Empirical Investigation

“…This study can assist three types of practitioners: (a) mobile app developers to understand the characteristics and the capability of the studied obfuscators and deobfuscators, (b) researchers and engineers to address the identified drawbacks and enhance the overall health of smartphone ecosystems, and (c) managers of cybersecurity academic programs to embed suitable obfuscation tools in their curricula [9]. This paper is organized as follows.…”