一句话：报告在 Web 应用开发课程中引入 SonarCloud 静态分析工具后，学生应用的安全问题显著减少。
论文延续此前评估，发现 2021–22 学年软件技术课程中的计算机科学本科生虽认为安全重要，却缺乏开发安全 Web 应用的能力，因此制定了一项培训计划。本文报告该计划在 2022–23 学年的实施结果与经验。计划的一项关键行动是要求学生在开发流水线中使用静态分析工具 SonarCloud 检测安全问题，但不强制修复。与 2021–22 学年相比，2022–23 学年开发的 Web 应用中安全问题数量显著减少。作者据此强调，应在大学课程中训练下一代开发者使用工具来支持安全软件开发。
In a previous publication, we presented the results of an assessment aimed at understanding whether bachelor students in Computer Science (CS) enrolled in a Software Technologies for the Web (STW) course were equipped to manage security concerns in the development of (e-commerce) web apps. The gathered evidence highlighted that students enrolled in this course in a.y. (academic year) 2021–22 were not equipped to develop secure web apps, although they devised security as a relevant development aspect. We then delineated a training plan to fill this gap. In this paper, we present the results from the enactment of this plan and the gained experience. In particular, our training plan involved (CS) bachelor students enrolled in the STW course in the a.y. 2022–23, and one of the implemented actions consisted of asking these students (who were different from those enrolled in the a.y. 2021–22) to use in their development pipeline a Static Analysis Tool (SAT), namely Sonar-Cloud, to detect security concerns. The students were asked to use SonarCloud, but not forced to remove detected security concerns. One of the most important results, deriving from the enactment of our intervention, was that the number of security concerns in the web apps developed in a.y. 2022–23 was significantly less than those developed in a.y. 2021–22. Since software security is nowa-days of primary relevance, we must train the next generation of developers to develop secure web apps and let them experience, in university courses, the use of tools to support the development of secure software.
@inproceedings{Nocera0FS24,
title = {Training for Security: Results from Using a Static Analysis Tool in the Development Pipeline of Web Apps},
author = {Sabato Nocera and Simone Romano and Rita Francese and Giuseppe Scanniello},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3639474.3640073}
}