Know Your Ten
Fernleaf Books ignores security updates that fix known flaws in its ageing software. This weakness leaves those known flaws exposed.
What is unpatched software?
A developer downloads a cracked debugging utility.
It quietly installs malicious software that begins stealing credentials from the development machine.
What is malware?
A stolen laptop from Redgum Physio turns out to be useless to the thief.
Every patient file on the disk is ciphertext without the key.
What is encryption?
Ironstone Health, a national insurer with $2 billion turnover, collects members' medical claims.
One Commonwealth Act, and the principles inside it, governs that data.
What is the Privacy Act 1988, containing the APPs?
Pasting company source code into a chatbot mid-build touches this named ethical issue.
What is use of AI during development?
The organisation behind the Essential Eight.
What is the Australian Signals Directorate (ASD)?
The APP requiring entities to keep personal information secure from misuse and unauthorised access.
What is APP 11?
A company has no clear privacy policy and cannot explain how it manages the personal information it collects.
What is APP 1?
A developer uses an approved AI tool to generate part of an application, but submits the code without checking whether it is secure or accurate. The company has broken no identified law, but the developer's conduct raises this type of concern.
What is an ethical issue?
Before building a payroll system, the team decides that only authorised staff should access employee records and that sensitive data must be protected during transmission.
What is defining security requirements?
Banksia Health wants to become the most trusted regional telehealth provider. This broad, long-term statement is this type of organisational direction.
What is a goal?
A developer at Kestrel Payroll hands in her resignation on Friday. Server logs later show she exported the full client list to a personal drive on the Thursday night, using her own valid login.
What is an insider threat?
A mobile app requests customer records through an established external server but never checks whether the logged-in user is authorised to view the customer ID being requested.
What is insecure use of APIs?
A bad deploy takes down Saltbush Cinema's booking site at 6 pm on a Friday.
By 6:15 the team has identified the exact change, the developer who made it, and rolled back to the previous working build.
What is version control?
A Victorian regional council launches a rates portal holding residents' names and addresses.
It answers to a state Act, not the Commonwealth one.
What is the Privacy and Data Protection Act 2014, containing the IPPs?
An auditor checks whether only authorised developers can access the code repository and whether all code changes are reviewed before release. These standards are examples of these.
What are evaluation criteria?
The strategy requiring a password plus something you have or something you are.
What is multi-factor authentication?
The APP governing when collected information may be used or disclosed for another purpose.
What is APP 6?
A Victorian council asks residents for information that has no connection to the service they are applying for.
What is IPP 1?
A contractor copies source code from a former employer's private repository and places it in a new commercial product without permission. The strongest concern here comes from this type of obligation.
What is a legal obligation? (copyright/IP)
During planning, developers identify that a stolen developer account could expose the source repository and customer data.
This is the threat-modelling step they are performing.
What is identifying threats?
To support that direction, Banksia aims to reduce appointment-booking errors by 30% within 12 months.
What is an objective?
At Tidemark Surf School, all four staff book lessons through one shared "admin" account.
When a customer's details are altered, nobody can say who did it.
What is poor IAM?
A developer connects through a fake public Wi-Fi hotspot. An attacker intercepts the connection and alters information travelling between the developer and the server.
What is a man-in-the-middle attack?
A junior developer at Wattleseed Bank runs a destructive test script.
Nothing happens to customers, because the database he touched contains only synthetic records on an isolated server.
What are separated environments (development, testing and production)
Stringybark Software wants to test against a copy of real customer records.
The framework, and the condition it imposes.
What is the ISM: the non-production environment must be secured to at least the same level as production?
A contractor lifts a search function from a previous employer's private repo, unlicensed and unattributed, into a new client's product. The named issues.
What are intellectual property and copyright issues?
The two strategies that deal with fixing known flaws in software.
What are patch applications and patch operating systems?
Ironstone Health wants to shift its member database to servers in Singapore. The APP that governs sending personal information overseas.
What is APP 8?
A Victorian agency collected information for one purpose, then provides it to another organisation for an unrelated purpose without an applicable exception.
What is IPP 2?
To meet a deadline, Pardalote Bank's developers knowingly bypass code review and security testing before pushing changes to production. No specific law has been identified, but the conduct raises this named ethical issue.
What are ineffective security practices?
After identifying the risk of stolen developer credentials, the team introduces MFA and restricts repository permissions.
What is mitigating threats?
A bank wants maximum control over its source code, security procedures and developer access, and already has an experienced development team.
What is in-house development?
Bluewren Apps prides itself on shipping fast. Pull requests are approved within minutes, usually with a thumbs-up emoji and no comments, and last month one sailed through containing a hardcoded password.
What is ineffective code review?
Developers discover that an unauthorised person gained access to their code repository and modified several source files before being detected.
What is a cyber security incident?
Logging into Currawong Legal's case system now takes a password plus a code from your phone, and paralegals can no longer open partner-level files.
Both changes are mechanisms of one control.
What is robust IAM?
Fairywren Council's app collects residents' dates of birth "because the form template had the field", and last year's flood-relief records remain on the live server with no review date. The two IPPs strained.
What are IPP 1 and IPP 4?
Corvid Payroll knows its password reset flow has a flaw that lets anyone hijack an account with just an email address. The fix is logged, deprioritised behind new features, and eighteen months later it remains unfixed. The named ethical issue.
What is ineffective security practices?
The strategy that would have saved Saltbush Cinema when ransomware encrypted every file on its server and the originals were gone.
What are regular backups?
A Victorian council's IT team discovers a decade of old resident records nobody needs. The IPP requiring data be protected, and destroyed or permanently de-identified when no longer needed.
What is IPP 4?
Residents cannot find any clear explanation of how a Victorian agency handles personal information or how they can access their records.
What is IPP 5?
A large Australian company subject to the Privacy Act places real customer records in an inadequately protected testing environment and the information is exposed. This creates obligations under this area rather than merely being poor professional judgement.
What is a legal issue involving privacy/data protection? (Privacy Act / APP 11)
An API flaw could expose every customer's record. The team identifies the threat, adds stronger authorisation checks to address it, then prepares to test whether the change works. This combines these two parts of threat modelling.
What is identifying and mitigating threats?
A retailer lacks specialist cyber security developers and contracts an experienced software company, gaining expertise but giving up some direct control.
What is external development?
Gumnut Grocers didn't write its delivery-tracking module; it licensed one from an overseas vendor.
When that vendor was breached, the compromised module went out in Gumnut's next release.
What is third party software risk?
Development, testing and the live system all share the same server and database. A destructive test script accidentally deletes real customer records.
What are combined development, testing and production environments?
After identifying several threats, an organisation introduces firewalls, antivirus protection and network monitoring to reduce their likelihood or impact.
What are mitigation measures? (KK4.02.09)
The Act protecting source code as a literary work
What is the Copyright Act 1968?
Lyrebird Logistics boasts its driver app has never been breached. An auditor instead checks three things: the security controls in place, its exposure to vulnerability and risk, and its legal compliance.
These three measure the effectiveness of this.
What is the security of software development practices?
The scale describing how thoroughly an organisation has implemented each strategy, and its range.
What are maturity levels, zero to three?
Lorikeet's app wants to use customers' Medicare numbers as account IDs. The APP restricting the adoption of government identifiers.
What is APP 9?
A Victorian agency plans to move residents' personal information to a service provider located outside Victoria.
What is IPP 9?
A developer copies a competitor's protected code into a new product.
Even if nobody ever discovers the copying, there are two different reasons the behaviour is unacceptable: one concerns compliance with the law; the other concerns professional conduct. Identify both concerns.
What are a legal copyright/IP issue and an ethical issue involving the misuse of another's work?
A security flaw has supposedly been fixed. Instead of assuming the new control works, the development team attempts the original attack again and checks whether the vulnerability can still be exploited.
What is confirming threats have been mitigated?
An organisation introduces secure-development induction and training, while formally documenting risks and responses before future projects begin. These are intended to achieve this overall outcome.
What is improving the security of software development practices?