一句话：通过课程实证研究规划将静态分析工具引入 Web 应用开发流程，以提升学生软件安全能力。
本文关注本科软件技术课程中，学生开发电子商务 Web 应用时普遍存在安全问题，需要有效的安全训练方案。作者设计了一项前瞻性实证研究，分为三步：分析 2021-22 学年选修 STW 课程学生的现状；制定 2022-23 学年的训练计划；实施计划并测量两届学生之间的差异。作为一篇 idea paper，本文报告前两步的结果以及拟议训练计划的评估策略。初步观察发现，2021-22 学年学生所开发 Web 应用的代码中安全问题广泛存在。因此，作者计划在 2022-23 学年要求学生在其开发流水线中使用静态分析工具（SAT）来检测安全问题，并通过对比两届学生来评估训练效果。
We designed a prospective empirical investigation to study our STW (Software Technologies for the Web) course with respect to the training of bachelor students in the context of software security when developing e-commerce Web apps. To that end, we devised the following steps: (i) studying the state of the students enrolled in the STW course in the a.y. (academic year) 2021-22; (ii) defining a training plan for the a.y. 2022-23; and (iii) acting the plan and measuring the differences (if any) between the students of the a.y. 2021-22 and 2022-23. In this idea paper, we present the results of the former two steps, as well as the evaluation strategy of the proposed training plan. We observed that security concerns are widespread in the code of the Web apps the students of the STW course (a.y. 2021-22) developed. Therefore, we plan (second step) to ask the students of the STW course (a.y. 2022-23) to use in their development pipeline a Static Analysis Tool (SAT) to detect security concerns.
@inproceedings{NoceraRFS23,
title = {Training for Security: Planning the Use of a SAT in the Development Pipeline of Web Apps},
author = {Sabato Nocera and Simone Romano and Rita Francese and Giuseppe Scanniello},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse-seet58685.2023.00010}
}