Preliminary Evaluation of a Software Security Learning Environment

摘要

The importance of software security technologies is increasingly recognized with the increase in services available on the Internet. It is important to foster human resources with knowledge and skills relevant to software security technologies. This paper proposes a learning process for software security and a learning environment that supports the learning process. In the learning process, learners create artifacts for software security (we call them "software security artifacts") from artifacts (we call them "software engineering artifacts") of a traditional software engineering course without dealing with software security, by referring to the knowledge base for software security (standards, methodologies, guidelines, security patterns, and so on). The learning environment supports storage of (1) software engineering artifacts, (2) software security artifacts, (3) a software security knowledge base, (4) rationale and association of the knowledge base with the software security artifacts, and (5) review comments and their association with the software security artifacts. We conducted a preliminary experiment to evaluate the learning process and the learning environment. We confirmed usefulness of the learning process. We also identified some improvements for the knowledge base system and learning environment, such as visualization support and traceability support.