Organisational Goals and Development Choices
This is a broad statement of what an organisation wants to achieve.
What is a goal?
This type of software is designed to damage, disrupt or gain unauthorised access to systems.
What is malware?
This security control requires users to prove their identity before accessing a system.
What is authentication?
In threat modelling, this means deciding what data, systems or code need to be protected.
What is defining security requirements?
This Commonwealth Act protects intellectual property such as source code, images, written content and other original works.
What is the Copyright Act 1968?
This is a specific, measurable outcome that helps an organisation achieve a goal.
What is an objective?
A developer uses old software that has known security flaws but has not been updated.
What is unpatched software?
This process converts readable data into unreadable data unless the correct key is used.
What is encryption?
This step involves finding possible attacks, weaknesses or risks that could affect the system.
What is identifying threats?
This Commonwealth privacy law includes Australian Privacy Principles about collection, use, disclosure and protection of personal information.
What is the Privacy Act 1988?
A school wants to reduce the time teachers spend entering attendance data. This is an example of software supporting this organisational aim.
What is improving efficiency/productivity?
A hacker secretly intercepts communication between a user and a web application.
What is a man-in-the-middle attack?
This control records changes to source code and allows developers to return to earlier versions.
What is version control?
This step involves applying controls such as encryption, access control, patching or code review.
What is mitigating threats?
This Victorian Act includes Information Privacy Principles that apply to Victorian public sector organisations.
What is the Privacy and Data Protection Act 2014?
This development option gives an organisation more control over source code, security practices and long-term maintenance.
What is developing software in-house?
A former employee still has access to the organisation’s code repository and downloads confidential source code.
What is an insider threat or poor identity and access management?
This security control involves another developer checking source code for errors, vulnerabilities and poor coding practices.
What is code review?
A team checks audit logs, patch records and code review results after security controls are applied. This is an example of this threat modelling principle.
What is confirming threats have been mitigated?
This Australian cybersecurity framework includes strategies such as patching applications, restricting administrative privileges, multi-factor authentication and regular backups.
What is the Essential Eight?
An organisation lacks specialist cybersecurity developers, so it hires an external software company. State one advantage and one disadvantage of this decision.
Advantage: access to specialist expertise. Disadvantage: less control, possible security/IP/privacy risks, or reliance on the external provider.
A software team uses the same environment for development, testing and production. Explain why this is a risk.
Testing or unfinished code could affect the live system; real data may be exposed; errors could be introduced into production; faults are harder to isolate.
Explain why development, testing and production environments should be separated.
Separation reduces the risk of unfinished or faulty code affecting the live system, protects real data, and allows testing to occur safely before deployment.
Write one criterion that could be used to evaluate the security of software development practices in an organisation.
Example: “Only authorised users can access source code and development data.” Evidence could include access logs, permission records, audit results or incident reports.
This Australian Government framework provides software development guidance about separating development, testing and production environments, secure software design and application security testing.
What is the Information Security Manual, or ISM?