A Survey of Security Concepts in Introductory Programming Courses in Finland

Background: To effectively counter cyber threats, developers must be trained to write secure code. In a university setting, this can be achieved by integrating security concepts into programming curricula from the earliest courses. Objective: This study examines how security concepts are currently integrated into university-level introductory programming courses, with a focus on course structure, current coverage, and the perceived value and feasibility of adding more security content. Method: A self-administered questionnaire was distributed to lecturers of introductory programming courses at Finnish universities. Results: We received 12 responses, covering 11 unique courses, which corresponds to a course coverage rate of 65%. Courses typically begin with basics like variables and data types, while advanced concepts such as encryption and logging are introduced later, if at all. The selection of programming and security concepts is shaped by the programming paradigm, which is primarily imperative, and by the application domain, which often focuses on desktop applications. Security-related concepts are often underrepresented in courses. Lecturers noted that programming projects provide the most effective context for introducing security concepts. Despite common challenges such as limited instructional time, curriculum constraints, and varying levels of student preparedness, lecturers suggested the use of supplementary materials, emphasizing the importance of security, and incorporating visualizations to support understanding.