# An Investigation into Educational Process Models for Teaching Secure Programming

Vuyolwethu Mdunyelwa, Lynn Futcher, Johan Van Niekerk

► To cite this version:

Vuyolwethu Mdunyelwa, Lynn Futcher, Johan Van Niekerk. An Investigation into Educational Process Models for Teaching Secure Programming. 16th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2022, Mytilene, Lesbos, Greece. pp.77-90, 10.1007/978-3-031-12172-2_7. hal-05324945

HAL Id: hal-05324945

https://inria.hal.science/hal-05324945v1

Submitted on 21 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# An Investigation into Educational Process Models for Teaching Secure Programming

Vuyolwethu Mdunyelwa<fnref n="1" />(✉) ID, Lynn Futcher<fnref n="1" /> ID, and Johan van Niekerk<fnref n="1" />,<fnref n="2" /> ID

**Abstract.** Despite the many advantages that software applications provide in our daily lives, there are also numerous threats that target vulnerabilities in these applications. There is therefore a demand for new technologies and approaches to secure software development. Educational institutions are responsible for equipping computing graduates with the requisite secure programming knowledge, skills and abilities. However, despite various curricula guidelines being provided by the ACM and other professional bodies, many educational institutions have not successfully implemented such changes within their curricula. One of the problems is that the available curricula guidelines focus more on *what* secure programming concepts should be taught, rather than *how*. This paper therefore investigates *how* educational process models could be used for teaching secure programming. It further identifies various themes and sub-themes from different educational process models and argues how these can be used to teach secure programming.

**Keywords:** Educational process model · Secure programming · Secure coding education

## 1 Introduction

The reliance on software applications for everyday operations has increased drastically in recent years. This is due to their central and underpinning role in enabling many functions in modern society [1]. However, the threats to software applications have also increased dramatically, often due to vulnerabilities existing within the application itself. A key challenge for software developers is therefore to ensure the security of these applications [2]. Educational institutions typically offer programming courses to learners enrolled in Computer Science, Information Technology, Information Systems, Software Engineering and other related qualifications [3]. In all these fields of study,

<footnote n="1">¹ Nelson Mandela University, Port Elizabeth, South Africa</footnote>

<footnote>{vuyolwethu.mdunzelwa,lynn.futcher}@mandela.ac.za</footnote>

<footnote n="2">² Noroff University College, Kristiansand, Norway</footnote>

<footnote>johan.vanniekerk@noroff.no</footnote>

<footnote>The financial assistance of the National Research Foundation (NRF) towards this research is hereby acknowledged. Opinions expressed and conclusions arrived at, are those of the author, and are not necessarily to be attributed to the NRF.</footnote>
learners are required to acquire at least some programming skills either at introductory level or throughout the qualification.

Programming is a complex activity with many challenges in teaching it since it draws on different knowledge domains and a variety of cognitive processes. Teaching secure programming adds to this challenge. Existing curricula guidelines focus on *what* secure programming topics should be taught and only provide limited guidance in terms of *how* this should be done [4, 5]. This paper therefore investigates how educational process models could be used for teaching secure programming through a thematic content analysis of existing models, critical reasoning and a practical example.

This paper starts with a discussion of the Research Methodology in Sect. 2, followed by Related Literature regarding secure programming education and training in Sect. 3 and Educational Process Models in Sect. 4. Section 5 follows with the Thematic Analysis of the most common educational process models and Sect. 6 provides a discussion of the educational process model elements most suited to teaching secure programming. Section 7 concludes the paper.

## 2 Research Methodology

This study entailed a literature study to highlight current research relating to secure programming education and educational process models. Furthermore, it included a thematic content analysis to determine the key elements of existing educational process models, and critical reasoning to identify and argue those elements most relevant to teaching secure programming.

A thematic content analysis was deemed relevant for this study since it is a form of analysis for qualitative data [6]. In a thematic content analysis, the researcher is required to closely examine the data to identify common themes, topics, ideas, and patterns of meaning that come up repeatedly [7]. This method of analysis is a more flexible approach to data analysis and can be adapted to many different kinds of research [8]. Various approaches to conducting a thematic content analysis exist. However, the most common form follows a six-step process, which includes familiarization, coding, generating themes, reviewing themes, defining and naming themes, and writing up, as described below: [6, 9, 10].

- **Familiarization** - is the first step and refers to understanding all the data collected to provide an overview for the analysis of the individual items.

- **Coding** - refers to highlighting sections of text or phrases. This leads to coming up with labels to describe their codes.

- **Generating Themes** - is where themes are generated from patterns identified from the codes that have been created.

- **Reviewing Themes** - includes a comparison of the data set to the generated themes for accuracy of the representation of data.

- **Defining and Naming Themes** - here the defining of themes involves the exact formulation for determining what they mean, while the naming of themes involves coming up with brief and easily understandable names for each theme.

- **Writing Up** - includes writing the analysis of data. This includes how data was collected, and how the thematic content analysis was conducted.
This six-step process has been applied to the thematic content analysis as discussed in Sect. 5.

## 3 Secure Programming Education and Training

To mitigate cybersecurity incidents in software applications, many researchers have proposed a Secure Software Development Life Cycle approach which suggests that security should be considered in all the phases in the SDLC [11]. In adhering to this approach, many software development teams in industry are required to attend security training for their relevant tasks [12]. Software development is an intensive and demanding task, which means that finding time for such training might be challenging, especially for developers who may not have the underlying security knowledge or who lack a security mindset [13]. Various successful approaches have been used to equip software development teams with secure programming knowledge, skills through the use of gaming, challenges and continuous cybersecurity educational approaches [14]. Many researchers propose the integration of such approaches throughout the undergraduate curriculum [13, 15].

Even though industry provides secure programming training for their software development teams, it is reported that their first encounters with the training is normally challenging since they would be required to think of their jobs with a security mindset [16]. It has been argued that the development and application of secure programming knowledge, skills and abilities in industry would be less challenging if developers had some fundamental academic background related to secure programming to draw upon [17]. Many security researchers also agree that secure programming is best integrated from introductory courses in first year to progressively more advanced courses throughout the qualification [18]. While existing computing curricula guidelines suggest topics for inclusion, this is often not done in many computing disciplines due to various challenges, including:

- Finding space in the curriculum which is already full [19].

- Lack of sufficient security relevant knowledge amongst computing instructors

- [20].

- Existing computing curricula's lack of guidance on *how* security should be taught [16].

In terms of instructors' knowledge relating to secure programming, this relates to *what* should be taught and what secure programming knowledge, skills and abilities the instructor should be equipped with. Some researchers assert that secure programming refers to programming that adheres to specific security requirements [13, 21]. An example of these requirements can be more generic, such as avoiding user problems by validating input or not using concatenated SQL commands [22].

This form of programming is referred to as *robust programming*, or defensive programming [23]. This requires the programmer to think more about what the program *can be made to do*, rather than thinking more about *what it should do*. This requires an attacker mindset which would guide programmers when developing software applications. Not only the attacker mindset is required when developing such applications, but
an implementation of security best practices which would address any unintended func-
tions for the program. Such security best practices are secure coding practices which
the programmer should know and implement when developing software applications
[24–26].

Secure coding practices are not entirely new programming concepts that need to be adopted, these are existing security best practices which require certain implementations to make them effective in securing software applications [25, 27]. An example would be securing an application against SQL injection which is a manipulation of SQL statements to modify data in the database. This can occur if input in a software application is not properly validated, or when developing the application, the programmers made use of concatenated SQL strings. In this case, addressing SQL injection would require a programmer to validate all input fields and make use of store procedures or parameterised SQL commands. Newly developed curricula guidelines provide a first step towards answering the question as to what these computing disciplines' cybersecurity should encompass [3, 15, 28]. Many computing curricula guidelines suggest the integration of cybersecurity throughout the computing curriculum, instead of treating it as a separate entity from the computing content. The 2017 Cybersecurity Curricula Guidelines (CSEC2017) provides recommendations for these computing disciplines and outlines various cybersecurity knowledge areas, broken into knowledge units and topics [15].

While the issue on the space in the curriculum might seem like one of the gate-
keepers for software security education, a more concerning issue is the assumption that
separate or new secure coding concepts are required to ensure a software application’s
security requirements are met during software development, which is not the case [29].
The reality is that programming curricula already include secure programming concepts
that the instructor may teach unknowingly to learners. This would lead to instructors
not correcting any insecurely written code in learners’ assessment due to the lack of
knowledge relating to secure coding practices amongst instructors [30]. While this lack
of knowledge amongst programming instructors is also a gatekeeper, various standards,
security organizations and curricula guidelines provide educational materials and guide-
lines which learners and instructors can use as resources for teaching and learning [25,
31–33]. This material would be useful to teaching programming and addressing their
lack of knowledge relating to secure coding practices.

In terms of addressing the *how* question in teaching secure programming, this seems
to be an issue, since educational settings differ.

4 Educational Process Models

An educational process model is a system of educational components which may be
derived from different process models or theoretical frameworks, which focuses on how
the learning process takes places in different or specific educational settings [34]. While
educational settings may differ according to whether teaching is done online, face-to-
face or any combination of these educational settings, the underlying elements remain
constant across these settings [35]. These underlying elements include learners, instruc-
tors, institutions, educational technology, and accrediting boards [36]. These diverse,
yet necessary elements, can be integrated through a conceptual framework, provided by an educational process model [37]. The diverse nature of educational settings and disciplinary subject matter has resulted in the development of various such educational process models. These include:

- **Systems Model of the Educational Process** - this educational process model builds on a Rhetoric process model, and include inputs, integrative process, output and feedback [35]. This is used to integrate educational components in a distance learning environment, and also provides room for virtual learning environments.

- **The Teaching/Learning Process Model** - This process model has been developed to categorize the variables which address how learners learn, and why learners learn better than others in a classroom environment [38]. This is designed for classroom settings and includes components such as inputs, teaching processes and outputs.

- **A Generalized Educational Process Model** - this presents a generic educational process model. This process model is based on three models, which are, the Information Space to provide resources for information, Nonaka's Model for knowledge acquisition and Bloom's Taxonomy for evaluating the effectiveness of education [39].

- **e-Learning Educational Process Model** - this provides a model for identifying the correct educational technologies for use in a virtual learning environment [36]. This process model is specific for virtual learning environments.

- **Educational Process Model for Research** - this provides an analysis of the educational process, and considers a variety of input components, and how these interact to affect the educational experience of learners [37]. Outputs from this educational process model are measured in different domains of learning, which includes the cognitive, affective and psycho-motor.

An example of the differences in educational subject matter may be depicted in applied subjects, such as programming when compared to more theoretical subjects, such as philosophy. In theoretical subjects, learners are required to absorb knowledge transmitted by the instructor, or read from a book, whereas in programming modules, learners are required to construct code, building recursively on pre-existing knowledge [40]. This provides a different view of teaching, where the instructor helps the learner to learn with more practical work, requiring immediate feedback, rather than simply presenting information to the learners [39]. The educational process models highlighted above focus on the input and outputs of such models, as well as the integration of the diverse elements required for educational settings.

While similarities exist amongst these educational process models, their use and interpretation differ. Some focus specifically on online educational settings, while some provide a generic process model for both online, traditional classroom, or a blended learning approach [39-41]. Therefore, no single process model satisfies all needs for secure programming education since this can be taught in various educational settings. This study argues that specific elements across the different process models exist which can be used to teach secure programming. Generic process models consider a number of elements, such as educational environment, faculty, and target audience.
## 5 Thematic Content Analysis of Educational Process Models

As discussed in Sect. 2, a thematic content analysis was conducted to determine the themes and sub-themes relating to the five educational process models as discussed in Sect. 4. These educational process models were selected based on the researcher's interpretation of their applicability in teaching secure programming. The selected process models are specific for education and include elements which are relevant for teaching secure programming. Table 1 shows the data sets resulting from the thematic content analysis.

<table><caption>**Table 1.** Thematic content analysis data set.</caption><thead><tr><td>Educational process model</td><td>Data set extracts</td></tr></thead><tbody><tr><td>Systems model of the educational process</td><td>input, integration, output, internal and external feedback, outcomes, experience, instructional technology, method, purpose, pedagogy, educational philosophy, resources</td></tr><tr><td>The teaching/learning process model</td><td>input, teacher/learner characteristics, classroom process, teacher/student behaviour, output, student achievement, school characteristics, context, school process</td></tr><tr><td>A generalized educational process model</td><td>Information Space (knowledge, data, information), Nonaka's model (socialization, externalization, combination, instructional material, Bloom's taxonomy</td></tr><tr><td>e-learning educational process model</td><td>participants (teachers, web content developers, web content, learners), context, media, output, experience</td></tr><tr><td>Educational process model for research</td><td>input, student, media, environment, instruction, teacher, curriculum, output, combination, cognitive, psychomotor, affective</td></tr></tbody></table>

The first step in the thematic content analysis is the *familiarization* which was done by reviewing the different elements of the educational process models discussed in Sect. 4. Common educational process models include three major components, which may include sub-components depending on the specific process model. Such components include inputs, integration/combination, and outputs from the different process models [37, 38]. A few educational process models which are specific for distance or online learning include feedback or reflection since the learning occurs in a virtual environment [35, 36]. Step two, *coding*, included identifying texts and phrases in the data sets collected from the identified educational process models and their elements. These texts and phrases are clearly shown in Table 1.

The third step, *generating the themes*, was achieved by identifying patterns from the codes created from the elements existing in the selected educational process models. The
patterns were identified from the elements which share the same meaning, or have the
same function. It was found that various educational process models use different terms
to refer to the educational experience provided by using the different input components
in an educational setting. Educational process models also use different terms to refer
to the process, such as combination, integration, or classroom process.

Step four, *reviewing of themes*, was achieved by comparing the themes to the exact codes of the educational process model elements for accuracy of their representation in the themes generated.

Step five, the *defining of themes* is provided in the discussion below where each generated theme (inputs, integration, output, and reflection) and their related sub-themes are discussed.

Figure 1 depicts the themes and sub-themes for this research which were generated from the data sets of the elements of the identified educational process models.

<figure><img src="image_3.png" /><figcaption>Fig. 1. Themes and sub-themes from educational process models.</figcaption></figure>

The next section defines and reports on the identified themes and sub-themes
identified.

**5.1 Inputs**

Inputs into the educational process model would need to be well thought through since they would determine the ultimate experience and whether the achievement of the desired goals will be successful. These inputs differ depending on the specific process model and its use. Inputs into educational process models refer to elements that enhance instructor and learners' teaching and learning experiences. The identified inputs include:

- **Curriculum** - this sub-theme refers to the content or the subject matter information, which is organised into a communicable form, to be conveyed to the learner [37]. This
includes characteristics such as structure, organisation, and sequence which refers to
how the flow of the information should be when teaching the learners [28].

- **Instructor** - the instructor sub-theme refers to the implementor of the curriculum [38]. This may take two forms, either an *instructor-implementor*, referring to a human being who is equipped with knowledge regarding the subject matter and is able to implement the curriculum, or the *implementor*, which refers to the technology used to implement and deliver the curriculum.

- **Learner** – the learner sub-theme includes the receptors in the educational process. This is important since it considers elements such as the learners' learning style, individual needs, and cultural differences [36, 42].

- **Media** – this sub-theme includes the different types of instructional material which is available for use inside and outside of the classroom [37]. Such instructional material includes internet, textbooks, slides, or videos and any medium learners use to receive information.

Once the inputs have been identified, these need to be integrated in the educa-
tional process, creating an effective learning experience. The next section discusses
the integration themes and its related sub-themes.

**5.2 Integration (Combination)**

This theme refers to the instructor and learner behaviour during the teaching and learning
process as well as the learner and instructor relationships [35, 37, 38]. This takes into
consideration the various input sub-themes and normalises them into a specific learning
domain. The identified integration themes include various sub-themes, namely:

- **Purpose** - this sub-theme includes determining the essential learning objectives, and aligning such objectives to the specialised needs of the inputs to the model, specifically those of the learners [35, 37].

- **Pedagogy** - this sub-theme refers to the integration of the input sub-themes of the educational process model in order to produce an educational experience [35]. The instructor enhances the educational experience through modifying the original objectives to suite the learners' needs and the available educational resources both from learner and the instructor [36].

- **Instructional Technology** - this sub-theme covers the available technology for instruction, taking into account the learners' ability to interact with the technology [37]. This combines the learner and the instructors' ability to use the instructional material to provide an effective educational experience.

Once the integration of the input sub-themes has occurred, there are a number of
measurable and immeasurable results that can either be the expected or unexpected
outputs from the learning experience [39]. The next sub-section discusses the output
theme and sub-themes generated from the educational process model data sets.
## 5.3 Output

This theme provides the outcomes of the learning experience [43]. Different learning outcomes and experiences may be produced depending on a number of factors, including learners, environment, and pedagogy [43].

The different learning outcomes also depend on the subject matter, since different learning outcomes are measured using different learning domains such as cognitive, psycho-motor, and affective as described below:

- **Cognitive** - this sub-theme refers to the *thinking* domain. This relates to how the learners acquire and process knowledge, and the different levels in which learners process the knowledge, as depicted in the Bloom's Taxonomy [37, 44].

- **Psycho-Motor** - once the learners have acquired the knowledge, they would be required to use the knowledge to produce some form of an artefact which would ensure that knowledge acquired is used [45].

- **Affective** - this sub-theme relates to how the learner feels after the learning experience. This depends on the learning experience and how the learner interacted with the content [45].

Some educational process models focus on all these learning domains, while some focus only on a single domain of learning.

The output theme provides the ability to address any unexpected results in the learning experience, since this provides feedback to an instructor. The next section discusses the final theme generated from the thematic content analysis data sets.

## 5.4 Reflection

The final theme identified from the educational process models is reflection/feedback, where the results from the output sub-theme could be used to suggest changes to the learning experience. Such changes may occur on the educational experience itself, or the technology, or any of the inputs.

# 6 Educational Process Model Elements for Teaching Secure Programming

This section discusses how the identified themes and sub-themes can be used to teach secure programming. An example of secure programming would include the use of stored procedures and validating input to address SQL injection, and this will be used to provide context in the following discussion.

## 6.1 Inputs for Teaching Secure Programming

This sub-section discusses the inputs relevant for teaching secure programming as generated from the data sets of the selected educational process models. The sub-themes for input in the model are listed below:
- **Curriculum** - this is necessary since it provides the topics and areas to focus on when teaching. This would require the instructor to acquire secure programming knowledge when preparing the content so that outputs can be measurable when the teaching and learning process is complete [38].

- **Instructor** - the instructor is required to have secure programming knowledge. For the above example, the instructor would have to be equipped with knowledge relating to SQL, input validation, stored procedures, and how these are implemented in order to deliver a software application which is not prone to SQL injection.

- **Learner** - in learning secure programming, the learner should have some prior programming knowledge to support what they are learning. When learning about SQL injection, they are required to have basic knowledge on input validation, SQL, and stored procedures providing an understanding of how SQL injection occurs when these are not implemented securely. They should also be provided with guidelines on how these should be implemented to provide a secure software application which will not be vulnerable to SQL injection.

- **Media** - this sub-theme is important for any teaching and learning environment, and in programming, this needs to address both the knowledge and behaviour of the learners and ensure effectiveness of both these aspects [2].

The inputs into the educational process model are important and differ on how they are used, providing a unique educational experience. Their use is further discussed in the integration theme, with the necessary sub-themes for teaching secure programming which are discussed in the next sub-section.

## 6.2 Integration for Teaching Secure Programming

This sub-section presents the integration of the inputs for teaching secure programming as generated from the different data sets of the selected educational process models:

- **Purpose** - the purpose provides the learning objective, and in referencing the SQL injection prevention example, this would include identifying concepts surrounding SQL injection which would be covered for teaching secure programming, such as SQL, input validation, and stored procedures.

- **Pedagogy** - in secure programming, an adopted pedagogy should be suitable for all the target audience needs. Also, this should address both the knowledge and behaviour aspects of learners by ensuring that learners acquire secure programming knowledge and are able to write secure code [46].

- **Instructional Technology** - this includes the technology required for teaching secure programming and what technology learners would be required to learn secure programming. For example, when teaching SQL injection, learners would be required to have database management software, an integrated development environment, and a computer which is able to run the software.

Once the integration of the sub-themes has occurred, outputs resulting from the integration would be evident. The next sub-section discusses the outputs which would
be required for measuring the effectiveness of the secure programming educational
process.

## 6.3 Outputs for Teaching Secure Programming

In programming, measuring effectiveness of education requires both the knowledge and behaviour aspects [47]. This sub-section discusses and aligns the output theme and its sub-themes.

- **Cognitive** - this is the primary requirement in any measurement of knowledge acquisition. However, in secure programming, this is not sufficient since learners need to demonstrate this through writing secure code.

- **Psycho-Motor** - in programming, a learner would be required to produce some form of an artefact which would be used to measure their behaviour relating to programming, and also to determine whether secure programming practices are adhered to when developing the artefact.

- **Affective** - this relates to the experience of the learner during the learning process. This can be enhanced by the instructor expanding on the planning of their course, including the teaching, activities and the teaching of secure programming.

The above output sub-themes are relevant for secure programming, however, an instructor may not be able to measure the affective domain in some environments such as the virtual environment. The final theme identified is reflection, as discussed in the next sub-section.

## 6.4 Reflection

Reflection provides feedback on the learning experience and allows for the improvement in the learning process to enhance the educational experience. In a secure programming environment, this is required since programming in general changes, and the vulnerabilities targeting software applications also change. New approaches to teaching which address such vulnerabilities should be provided as well as updates and changes to the curriculum [35].

# 7 Conclusion

This paper investigated the use of educational process models for teaching secure programming. Five educational process models were reviewed for common educational elements resulting in themes and sub-themes generated from the data sets extracted from the thematic content analysis conducted. This study argues that the identified themes and sub-themes are required for teaching secure programming and can be used in different educational settings. It also motivates the importance of the reflection theme which allows the educational experience to the improved, through changing the various themes and sub-themes. This study only focused on five educational process models due to the researchers interpretation of their applicability in teaching secure programming. Future
research will include case study of the selected themes and sub-themes used in different educational settings putting into context the selected themes and sub-themes to teach secure programming.

## References

1. Auch, M., Weber, M., Mandl, P., Wolff, C.: Similarity-based analyses on software applications: a systematic literature review. J. Syst. Softw. **168**, 110669 (2020). https://doi.org/10.1016/j.jss.2020.110669

2. Gasiba, T., Lechner, U., Cuellar, J., Zouitni, A.: Ranking secure coding guidelines for software developer awareness training in the industry. OpenAccess Ser. Inform. **81**(11), 1–11 (2020)

3. Sabin, M., Alrumaih, H., Impagliazzo, J., Lunt, B., Zhang, M.: ACM/IEEE. 2017 information technology curricula 2017: curriculum guidelines for baccalaureate degree programs in information technology. Technical report (2017)

4. I.E. Commission and S. S. Division, SANS 27034-1: 2013 South African National Standard Information technology—Security techniques—Application security Part 1: Overview and concepts (2013)

5. Lunt, B., Sabin, M., Hala, A., Impagliazzo, J., Zhang, M.: Information technology curricula 2017. Association for Computing Machinery (ACM) IEEE Computer Society, Technical report (2017)

6. Anderson, R.: Thematic content analysis (TCA). Descriptive Present. Qual. Data **15**, 1–4 (2007)

7. Xiao, Y., Watson, M.: Guidance on conducting a systematic literature review. J. Plan. Educ. Res. **39**(1), 93–112 (2019)

8. Cairns, A.H., et al.: Using semantic lifting for improving educational process models discovery and analysis. In: CEUR Workshop Proceedings, vol. 1293, pp. 150–161 (2014)

9. Caulfield, J.: How to do thematic analysis—a step-bystep guide & examples. Scribbr, pp. 1–9 (2020). https://www.scribbr.com/methodology/thematic-analysis/

10. Nowell, L.S., Norris, J.M., White, D.E., Moules, N.J.: Thematic analysis: striving to meet the trustworthiness criteria. Int J Qual Methods **16**(1), 1–13 (2017)

11. Nehouse, W., Keith, S., Scribner, B., Witte, G.: NIST 2017 national initiative for cybersecurity education (NICE) cybersecurity workforce framework. Technical report, November 2017. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-181.pdf

12. Gasiba, T., Lechner, U., Rezabek, F., Pinto-Albuquerque, M.: Cybersecurity games for secure programming education in the industry: gameplay analysis. In: Queirós, R., Portela, F., Pinto, M. (eds.) First International Computer Programming Education Conference (2020)

13. Nance, K., Hay, B., Fairbanks, A., Bishop, M.: Secure coding education: are we making progress?, pp. 83–88 (2012)

14. Gasiba, T., Lechner, U., Pinto-Albuquerque, M., Zouitni, A.: Design of secure coding challenges for cybersecurity education in the industry. In: Shepperd, M., Brito e Abreu, F., Rodrigues da Silva, A., Pérez-Castillo, R. (eds.) QUATIC 2020. CCIS, vol. 1266, pp. 223–237. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-58793-2_18

15. Burley, D., Bishop, M., Buck, S., Ekstrom, J., Futcher, L.: Cybersecurity Curricula 2017, no. December (2018)

16. Carneiro, D., Silva, R.: Game elements, motivation and programming learning: a case study. In: First International Computer Programming Education Conference (2020)

17. Zuzana, K., Iveta, D.: Using code review at school and at the programming club. In: First International Computer Programming Education Conference (2020)
18. Espinha Gasiba, T., Lechner, U., Pinto-Albuquerque, M., Mendez, D.: Is secure coding education in the industry needed? An investigation through a large scale survey, no. February, pp. 241–252 (2021)

19. Bishop, M., et al.: Cybersecurity curricular guidelines. In: Bishop, M., Futcher, L., Miloslavskaya, N., Theocharidou, M. (eds.) WISE 2017. IAICT, vol. 503, pp. 3–13. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-58553-6_1

20. Dark, M.J., Lauren, S., Ngambeki, I., Bishop, M.: Effect of the secure programming clinic on learners’ secure programming practices (2016)

21. Taylor, B., Bishop, M., Hawthorne, E., Nance, K.: Teaching secure coding- the myths and the realities. In: Proceeding of the 44th ACM Technical Symposium on Computer Science Education (SIGCSE 2013), no. March 2013, pp. 281–282 (2013)

22. Conde, V., Queirós, R.: First International Computer Programming Education Conference Ricardo Queirós Filipe Portela Mário Pinto (2020)

23. Bishop, M., Dai, J., Dark, M., Ngambeki, I., Nico, P., Zhu, M.: Evaluating secure programming knowledge. In: Bishop, M., Futcher, L., Miloslavskaya, N., Theocharidou, M. (eds.) WISE 2017. IAICT, vol. 503, pp. 51–62. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-58553-6_5

24. Mdunyelwa, V., Futcher, L., Van Niekerk, J.: A framework for teaching secure coding practices through a blended learning approach (2020)

25. OWASP: OWASP Top 10 Web Application Security Risks. Technical report (2020). https://owasp.org/www-project-top-ten/

26. SANS Institute: 2011 CWE/SANS Top 25 Most Dangerous Software Errors. SANS Institute, pp. 1–25 (2011). http://cwe.mitre.org/top25/#CWE-78

27. Rindell, K., Ruohonen, J., Holvitie, J., Hyrynsalmi, S., Leppänen, V.: Security in agile software development: a practitioner survey. Inf. Softw. Technol. **131**(November 2020), 106488 (2021)

28. Ardis, M., Budgen, D., Hislop, G.W., Offutt, J., Sebern, M., Visser, W.: SE 2014: curriculum guidelines for undergraduate degree programs in software engineering. Computer **48**(11), 106–109 (2015)

29. Scholte, T., Balzarotti, D., Kirda, E.: Have things changed now? An empirical study on input validation vulnerabilities in web applications. Comput. Secur. **31**(3), 344–356 (2012)

30. Espinha Gasiba, T., Lechner, U., Pinto-Albuquerque, M.: Sifu - a cybersecurity awareness platform with challenge assessment and intelligent coach. Cybersecurity **3**(1), 1–23 (2020)

31. SANS/CWE: CWE-2019 CWE Top 25 Most Dangerous Software Errors. Technical report (2019). https://cwe.mitre.org/top25/

32. The Acunetix Team: Acunetix Web Application Vulnerability Report 2019. Technical report (2020)

33. IBM: Security Cost of Data Breach (2019). https://www.ibm.com/downloads/cas/

34. Ruan, Y.: Educational process modelling with workflow and time petri nets. Ph.D. dissertation (2005)

35. Beck, C.E., Schornack, G.R.: Systems Model of Educational Processes. Encyclopedia of Distance Learning, 2nd edn, pp. 2008–2016 (2011)

36. Rashty, D.: eLearning processes models, pp. 1–7 (1998)

37. Armstrong, J.R.: An educational process model for use in research. J. Exp. Educ. **39**(1), 2–7 (1970)

38. Huitt, W.: A transactional framework of the teaching/learning process: a summary (2003). http://www.edpsycinteractive.org/materials/mdltlp.html

39. Tujarov, H., Avramova, S., Kalchev, S., Stefanova, M.: Educational process model. In: Proceedings of the 9th International Conference on Computer Systems and Technologies and Workshop for PhD Students in Computing, CompSysTech 2008, no. January 2008 (2008)

40. Adkins, M., Nitsch, W.: Student retention in online education. In: Encyclopedia of distance learning (1944)
41. Dees, D.M., Ingram, A., Kovalík, C., Allen, M., Mcclelland, A., Justice, L.: A transactional model of college teaching. Int. J. Teach. Learn. High. Educ. **19**(2), 130–139 (2007)

42. Kwek, C.L., Lau, T.C., Tan, H.P.: Education quality process model and its influence on students' perceived service quality. Int. J. Bus. Manag. **5**(8), 154 (2010)

43. Münch, J., Armbrust, O., Kowalczyk, M., Soto, M.: Descriptive process models, no. March (2012)

44. Bloom, B.S., Engelhart, M.D., Furst, E.J., Hill, W.H., Krathwohl, D.R.: The Classification of Educational Goals (1956)

45. Fawcett, G., Juliana, M.: Teaching in the digital age. In: Designing Instruction for Technology-Enhanced Learning, pp. 71–82 (2015). http://opentextbc.ca/teachinginadigi talage/%5Cn, http://services.igiglobal.com/resolvedoi/resolve.aspx?doi=10.4018/978-1-930 708-28-0.ch004

46. Mdunyelwa, V.S., Van Niekerk, J.F., Futcher, L.A.: Secure coding practices in the software development capstone project. In: Proceedings of the Eleventh International Symposium on Human Aspects of Information Security & Assurance (HAISA 2017) Secure, no. HAISA, pp. 282–291 (2017)

47. Mdunyelwa, V., Futcher, L., van Niekerk, J.: An educational intervention for teaching secure coding practices. In: Drevin, L., Theocharidou, M. (eds.) WISE 2019. IAICT, vol. 557, pp. 3– 15. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-23451-5_1