CSE-60770 (40770) Secure Software Engineering

This class includes the following graded components:

• Case Study: An in-depth investigation of security challenges experienced by a real software product. While in class you will be learning about security tactics, common weaknesses, and secure coding practices, in the case study you will see investigate how those concepts are applied (or not at all). The outcome is a technical report.
• Seminar Presentation: Every student will select (or be assigned) one paper on a course-related topic. The student is to gain a detailed understand of the paper, and present it to the class. The student should highlight the motivation of the work, its novel contributions, any surprising findings and possible applications of the work. This also includes a critique which contains at least three strengths of the paper and at least three weaknesses of the paper.
• Course Project: In lieu of examinations, this class will have a course project in which the students would be working throughout the semester. You are expected to work on the course project individually. Each student is expected to write a research paper by the end of the semester. The topic is to be negotiated with the instructor. Examples include: building a tool to support secure software engineering practices, or a survey paper of a software security related topic (typically involves surveying several research papers), or empirical studies, etc. The final report (10 pages of context, +2 pages of reference, +5 pages for appendixes) should be submitted by the end of the semester. All project-related documents (i.e., project proposal and project report) should use the IEEE conference publication format. If the paper is deemed publishable, the instructor will work with the student to make appropriate changes to the final report and submit the paper for publication.
• Homeworks: Each lecture cover a different practice or tool. The homeworks are intended for the student to apply the studied concepts in class. Most of these homeworks are individual (i.e., unless specified otherwise, the homeworks should be individual submissions).
• Attendance & In-Class Participation: Attendance and participation is required. Classes may also include short hands-on activities/exercises that are submitted during class or by the next class section. These also may be used as points towards attendance.

Your final course grade is computed according to the following breakdown:

Grades are assigned as follows:

Deadlines are strictly enforced. There is a penalty of 15% for submissions up to 12hrs past the deadline. Submissions made more than 12hrs past the deadline are not accepted (i.e., they will be assigned 0). Please plan ahead your assignments.

HOWEVER...
Life Happens. We all lead densely-layered lives; therefore, one of my core values is leading with grace. As a result, I institute a “Life Clause”. Should you need it, you may invoke the “Life Clause” on TWO homeworks, and get a 2-day extension, no explanation required. To invoke a life clause, please fill out this request form by 5PM on the day of the homework's deadline. The TA will process the request within one business day and add the extension on Gradescope.

Notice: the life clause is only for homeworks.

• No extensions are given to activities because they are meant to be low-stakes assignments that can help you stay on track and follow the course content. Giving extensions would defeat the purpose of these activities.
• The project, case study, and seminar has hard deadlines and no extension will be given to any student.

To maintain fairness, the professor DOES NOT grant extensions on a case-by-case basis (i.e., the rules laid out in here applies to all students -- without exceptions).

It is cheating to copy, to allow another person to copy, all or part of an exam or an assignment, or to fake program output. It is also a violation of the Undergraduate Academic Code of Honor to observe and then fail to report academic dishonesty. You are responsible for the security and integrity of your own work.

For the individual assignments in this class, you may discuss with other students and consult printed and online resources. You may quote from books and online sources as long as you cite them properly. However, you may not look at another student's solution, and you may not copy any significant portions of other's solutions.

For the assignments made in groups, the same rules apply. The main difference is that you are allowed -- and expected -- to discuss specifics of the solution for your submission with your team members (i.e., students in your group). However, the group may not copy a solution from elsewhere (i.e., another team, book, tutorial, etc.).

Notice that since this class does not have an exam, and instead, has a large course project, any honor code violation to the project will be reported as a major violation.

The "Pencils Down" Rule: You may communicate about homework with your classmates at a high-level, give general advice, and chat about common problems. You may not communicate specific knowledge such as problem solutions or steps or planning documents. A good litmus test is if you would need to write it down to communicate or remember something, it is off limits. Seek homework help from the Professor or the TAs instead.

The following table summarizes how you may work with other students and use print/online sources:

See the CSE Guide to the Honor Code for definitions of the above terms.

Policies on the Use of Text/Code Generation Tools (ex: ChatGPT, GitHub Copilot, etc.)

The use of text generation tools (ex: ChatGPT) or code generation tools (ex: GitHub Copilot) introduces authorship issues. As expressed above, this course expects that submitted assignments are a result of a student's individual effort (or group effort, for those assignments submitted in groups). Text generation tools can include not only factual errors but also may plagiarize other works. In light of these concerns, this class will follow similar guidelines from the ACL 2023 policy on AI writing assistance. Thus, these AI tools can only be only used under the conditions outlined below. Notice that the text in blue is from the ACL 2023 policy, whereas the text written in black is what has been tailored to our class setting.

• ✅ Allowed Assistance purely with the language of the paper. When generative models are used for paraphrasing or polishing the author’s original content, rather than for suggesting new content - they are similar to tools like Grammarly, spell checkers, dictionary and synonym tools, which have all been perfectly acceptable for years. Thus, using these AI tools solely to assist with the writing is not an honor code violation.
• ✅ Allowed Short-form input assistance. Even though predictive keyboards or tools like smart compose in Google Docs are also powered by generative language models, nobody objected to them, since hardly anyone would try to use them to generate a long, unique and coherent text: it would simply not be practical. Thus, using these AI tools solely to autocomplete small pieces of text/code (i.e., words, variable names, etc) is not an honor code violation.
• ⚠️ Allowed but use with caution Literature search. Generative text models may be used as search assistants, e.g. to identify relevant literature. However, we expect the authors to read and discuss such references, just like the references identified by a regular search engine or a semantic literature recommendation tool. The usual requirements for citation accuracy and thoroughness of literature reviews apply; beware of the possible biases in suggested citations. That is, you can use AI assistant tools to help you find relevant related work, but you still need to manually vet them, and cite them accordingly.
• ⚠️ Allowed with disclosure Code Generation for "Common Code": If a code generation tool (GitHub Copilot) is used similarly to StackOverflow, i.e., to understand how to write "common code" in a specific programming language (ex: how to open a file in python), that is allowed. However, the submission must disclose this use by including a comment near the generated code indicating the use of GitHub Copilot (or other tool).
• ❌ Not AllowedLow-novelty text. Some authors may feel that describing widely known concepts is a waste of their time and can be automated. Since this is a class where the main goal is to learn, students must describe and cite widely known concepts on their own. This process should not be automated by writing assistants.
• ❌ Not AllowedNew ideas. If the model outputs read to the authors as new research ideas, that would deserve co-authorship or acknowledgement from a human colleague, and that the authors then developed themselves (e.g., topics to discuss, framing of the problem), then the text/idea should not be used for any assignment in this class.
• ❌ Not AllowedNew ideas + new text: a contributor of both ideas and their execution seems to us like the definition of a co-author, which the models cannot be. Therefore, it should not be used for this purpose in this class.

Per stated in Section 2.4.1 of the Undergraduate Academic Code of Honor "Faculty and anyone else responsible for teaching or assisting in a course will not tolerate academic dishonesty.". Therefore, if an instructor sees behavior that is academically dishonest, that professor is required to file either an Honor Code Violation Report (HCVR) or a formal report to the College of Engineering Honesty Committee.