Software Security and Secure Coding Practices

Active learning works for software security because students need to experience how small coding choices lead to real vulnerabilities. When students analyze real code snippets, they see that security flaws are not abstract concepts but predictable mistakes that can be identified and fixed early in development.

• 12th Grade
• Computer Science
• 3 activities
• 40 min–50 min

Learning Objectives

1. Analyze common web application vulnerabilities, such as SQL injection and cross-site scripting, by examining provided code snippets.
2. Evaluate the security implications of specific coding choices, explaining how they could lead to vulnerabilities.
3. Design a set of secure coding guidelines for a given software development scenario, prioritizing mitigation strategies for common threats.
4. Critique a piece of code for potential security flaws, identifying specific lines and suggesting secure alternatives.
5. Demonstrate the mitigation techniques for at least two common software vulnerabilities through code modification.

Collaborative Problem-Solving

⏱ 40 min·Pairs

Code Review Challenge: Spot the Vulnerability

Give each pair a printed or screen-shared code snippet containing one or two deliberate vulnerabilities (SQL injection, missing input validation, hard-coded credentials). Pairs annotate the code identifying the vulnerability, explaining why it is exploitable, and proposing a fix. Each pair then presents their analysis to an adjacent pair for critique before the class compares findings.

Prepare & details

Explain the importance of secure coding practices throughout the software development lifecycle.

Facilitation Tip: During the Code Review Challenge, ask students to annotate their reasoning directly on the code snippets to make their thought process visible.

Setup: Groups at tables with problem materials

Materials: Problem packet, Role cards (facilitator, recorder, timekeeper, reporter), Problem-solving protocol sheet, Solution evaluation rubric

• Apply
• Analyze
• Evaluate
• Create
• Relationship Skills
• Decision-Making
• Self-Management

Gallery Walk

⏱ 50 min·Pairs

Gallery Walk: OWASP Top 10

Create eight to ten stations around the room, each dedicated to one OWASP Top 10 category. Each station includes a one-paragraph description, a simplified code example showing the vulnerable pattern, and a question prompt. Student pairs rotate through stations and record: the attack name, how it works, and the mitigation. A class debrief synthesizes the patterns.

Prepare & details

Identify common software vulnerabilities like buffer overflows and cross-site scripting.

Facilitation Tip: For the Gallery Walk, position OWASP Top 10 posters at stations and have students rotate in small groups to discuss one vulnerability per stop.

Setup: Wall space or tables arranged around room perimeter

Materials: Large paper/poster boards, Markers, Sticky notes for feedback

• Understand
• Apply
• Analyze
• Create
• Relationship Skills
• Social Awareness

Collaborative Problem-Solving

⏱ 45 min·Small Groups

Design Workshop: Secure Coding Guidelines

Small groups are assigned the role of a lead developer creating a one-page secure coding guide for new team members. Each group drafts guidelines for input validation, authentication, error handling, and dependency management. Groups exchange drafts and use a rubric to identify gaps, then refine their guide based on peer feedback before a final class share-out.

Prepare & details

Design a set of secure coding guidelines for a development team.

Facilitation Tip: In the Design Workshop, provide a checklist of secure coding guidelines and have students justify each item’s inclusion before applying it to sample code.

Setup: Groups at tables with problem materials

Materials: Problem packet, Role cards (facilitator, recorder, timekeeper, reporter), Problem-solving protocol sheet, Solution evaluation rubric

• Apply
• Analyze
• Evaluate
• Create
• Relationship Skills
• Decision-Making
• Self-Management

Teaching This Topic

Teach this topic by having students confront real vulnerabilities firsthand rather than memorizing a list of risks. Research shows that students retain security concepts better when they debug flawed code than when they read about them. Avoid lectures that separate theory from practice; instead, weave security principles into coding exercises to reinforce their relevance.

What to Expect

By the end of these activities, students should confidently identify common vulnerabilities in code, explain why they occur, and apply secure coding practices to fix them. They should also recognize that security is everyone’s responsibility, not an afterthought.

Watch Out for These Misconceptions

Common Misconception

During the Gallery Walk, some students may assume that security is only the security team's responsibility.

What to Teach Instead

During the Gallery Walk, direct students to the OWASP Top 10 posters that highlight developer-introduced vulnerabilities, such as injection and broken authentication, to emphasize that most risks originate in code written by developers.

Common Misconception

During the Code Review Challenge, students might believe input validation is only necessary for user-facing forms.

What to Teach Instead

During the Code Review Challenge, point out how the vulnerable snippets often include API responses and internal service calls, showing that validation is required for all external data, not just visible forms.

Common Misconception

During the Design Workshop, students may think using a framework automatically protects against vulnerabilities.

What to Teach Instead

During the Design Workshop, use framework documentation to demonstrate how misuse, such as disabling security features or using raw SQL queries, reintroduces vulnerabilities the framework was meant to prevent.

Assessment Ideas

Quick Check

After the Code Review Challenge, present students with new code snippets and ask them to identify vulnerabilities, explain their impact, and suggest secure coding fixes.

Peer Assessment

During the Code Review Challenge, have students work in pairs to review an intentionally vulnerable code module and write a brief report for each flaw, explaining the issue and proposing corrected code.

Discussion Prompt

After the Design Workshop, facilitate a class discussion where students debate the top three secure coding practices for a new social media app and justify their choices based on user privacy and data protection.

Extensions & Scaffolding

• Challenge: Have students research a recent security incident involving a web application and present how a secure coding practice from the OWASP Top 10 could have prevented it.
• Scaffolding: Provide a partially completed secure coding checklist for students to fill in as they review code, focusing on one vulnerability at a time.
• Deeper exploration: Assign students to compare secure and insecure versions of the same code snippet, documenting the differences and explaining the security implications of each change.

Key Vocabulary

SQL Injection	A code injection technique that executes malicious SQL statements. This occurs when user input is not properly validated or escaped before being included in a database query.
Cross-Site Scripting (XSS)	A type of security vulnerability where attackers inject malicious scripts into web pages viewed by other users. This often exploits a lack of output encoding.
Buffer Overflow	A vulnerability where a program writes data beyond the boundary of a buffer, potentially overwriting adjacent memory and causing unexpected behavior or security breaches.
Input Validation	The process of checking data provided by users or external systems to ensure it conforms to expected formats, types, and ranges before it is processed.
Output Encoding	The process of converting data into a format that is safe to be displayed or used in a specific context, preventing it from being interpreted as executable code.