"I Don't Know Too Much About It": On the Security Mindsets of Computer Science Students

TL;DR

This study explores the security perceptions and practices of computer science students, revealing their hacker mindsets, trust in others' code, and gaps in security API experience, which influence future software security education.

Contribution

It provides new insights into students' security attitudes, highlighting their similarities to professionals and informing curriculum improvements.

Findings

Students exhibit hacker and attack mindsets.

Students often lack experience with security APIs.

Students tend to trust others' code for rapid development.

Abstract

The security attitudes and approaches of software developers have a large impact on the software they produce, yet we know very little about how and when these views are constructed. This paper investigates the security and privacy (S&P) perceptions, experiences, and practices of current Computer Science students at the graduate and undergraduate level using semi-structured interviews. We find that the attitudes of students already match many of those that have been observed in professional level developers. Students have a range of hacker and attack mindsets, lack of experience with security APIs, a mixed view of who is in charge of S&P in the software life cycle, and a tendency to trust other peoples' code as a convenient approach to rapidly build software. We discuss the impact of our results on both curriculum development and support for professional developers.