一句话：分享软件安全课程经验，将漏洞发现映射到OWASP ASVS安全控制，并评估其提升学生理解的效果。
软件从业者缺乏安全专业知识，教育者需要设计综合性软件安全课程的指导。本文分享第十一次开设软件安全课程的经验，课程目标涵盖安全测试、安全设计与编码、安全需求及安全风险管理。在第十一年，课程作业首次将漏洞发现映射到OWASP应用安全验证标准（ASVS）的安全控制。基于期末探索性渗透测试项目的学生表现，这种映射可能加深了学生对更广泛安全主题的理解。学生在三小时内于正在使用的电子健康记录应用OpenMRS中高效检测出191个经确认的唯一漏洞，涵盖28种CWE类型。
Lack of security expertise among software practitioners is a problem with many implications. First, there is a deficit of security professionals to meet current needs. Additionally, even practitioners who do not plan to work in security may benefit from increased understanding of security. The goal of this paper is to aid software engineering educators in designing a comprehensive software security course by sharing an experience running a software security course for the eleventh time. Through all the eleven years of running the software security course, the course objectives have been comprehensive - ranging from security testing, to secure design and coding, to security requirements to security risk management. For the first time in this eleventh year, a theme of the course assignments was to map vulnerability discovery to the security controls of the Open Web Application Security Project (OWASP) Application Security Verification Standard (ASVS). Based upon student performance on a final exploratory penetration testing project, this mapping may have increased students' depth of understanding of a wider range of security topics. The students efficiently detected 191 unique and verified vulnerabilities of 28 different Common Weakness Enumeration (CWE) types during a three-hour period in the OpenMRS project, an electronic health record application in active use.
@inproceedings{paperbot6275,
title = {Structuring a Comprehensive Software Security Course Around the OWASP Application Security Verification Standard},
author = {Sarah Elder and Nusrat Zahan and Valeri Kozarev and Rui Shu and Tim Menzies and Laurie Williams},
booktitle = {ICSE},
year = {2021},
doi = {10.1109/icse-seet52601.2021.00019}
}