Designing a Platform to Train Secure Programming Skills with Attack-and-Defend Exercises

The increasingly poor state of software security poses significant threats to many of modern society's critical functions. Computing educators play a pivotal role in equipping future software engineers with the necessary skills to build secure systems. However, while traditional security courses often focus on conceptual knowledge, practical application is crucial for ensuring students can develop robust, secure software. Despite the importance of hands-on experience, students often lack suitable platforms for practicing secure programming. Inspired by drill-and-practice platforms that effectively train general programming skills, we have been working on a similar platform that focuses explicitly on teaching secure coding practices through active learning strategies. In this paper, we discuss the design of our prototype implementation: SecureCoder. Rooted in active learning principles, SecureCoder's design aims to promote student-centered education by encouraging students to actively apply theoretical secure programming concepts. Specifically, SecureCoder engages students with interactive attack-and-defend exercises, challenging them to exploit or patch software vulnerabilities in a sandboxed environment. Our ultimate objective is to bridge the gap between theoretical knowledge and practical application, fostering a deeper understanding and retention of secure coding principles. Through immediate and actionable feedback on validated exercises, SecureCoder is designed to reinforce learning and empower students to iteratively refine their solutions and build confidence in their skills. To study the potential of our design, we conducted a pilot study. The study results indicate that participants found SecureCoder to be relevant and engaging. Further, participant perceptions toward the attack-and-defend exercises suggest that SecureCoder's design has the potential to enhance secure programming education. Encouraged by SecureCoder's initial positive reception, we plan to open-source the project, inviting the broader education community to contribute to and benefit from shared security expertise. These collaborative efforts are essential for educating the next generation of security-aware software engineers. By integrating hands-on practice and active learning techniques, SecureCoder's design aims to address the urgent need for practical, skill-based security education, preparing students to meet the ever-evolving challenges of engineering secure solutions in the real world.