VCE Software Development - U4O2 - Cyber Security: secure software development practices

1 Goals and objectives of medium and large organisations 2 Security as an organisational objective 3 Medium and large organisations compared 4 In-house development: advantages 5 In-house development: disadvantages 6 External development: advantages 7 External development: disadvantages 8 Choosing in-house or external development 9 Asset 10 Threat 11 Threat actor 12 Vulnerability 13 Exploit 14 Attack surface 15 Confidentiality 16 Integrity 17 Availability 18 Risk as likelihood and impact 19 Software vulnerabilities 20 Cyber security incident 21 Data breach 22 Development, testing and production environments 23 What makes a development environment insecure 24 What an API is 25 Risks of using APIs 26 Hard-coded API keys and secrets 27 Malware 28 Spyware 29 Ransomware 30 Outdated versions of software 31 Zero-day vulnerabilities 32 Unpatched software in a development environment 33 Poor identity and access management practices 34 Weak passwords 35 Improper credential management 36 Man-in-the-middle attacks 37 Risks of unsecured public Wi-Fi 38 Insider threats and human error 39 Software supply chain 40 Third-party dependencies 41 Compromised software updates 42 Typosquatting and malicious packages 43 Risks of software acquired from third parties 44 Ineffective code review practices 45 Input validation 46 SQL injection 47 Combined development, testing and production environments 48 Version control for software projects 49 Code repositories 50 Securing a code repository 51 Authentication vs authorisation 52 The principle of least privilege 53 Role-based access control 54 Types of MFA 55 How MFA protects an account when the password is stolen 56 Access logs and audit trails 57 Encryption and decryption 58 Symmetric encryption 59 Asymmetric encryption 60 Encrypting data at rest and in transit 61 HTTPS and the padlock 62 Peer code review process 63 Automated code analysis tools 64 Patch management 65 Operating system updates 66 Separating development, testing and production environments 67 Managing secrets outside source code 68 Code signing and trusted sources 69 Software bill of materials (SBOM) 70 Reducing supply chain risk 71 What threat modelling is 72 Defining security requirements 73 Writing measurable non-functional requirements 74 Data flow diagram of a system 75 Trust boundaries 76 STRIDE threat categories 77 Attack trees 78 Risk rating matrix 79 Writing a threat model table 80 Security controls: prevent, detect, respond 81 Identifying and mitigating threats 82 Confirming threats have been mitigated 83 Ethical hacking 84 Reviewing and updating a threat model 85 Criteria for evaluating the security of software development practices 86 Rating a practice against a criterion with evidence 87 Analysing an organisation's software development practices 88 Identifying vulnerabilities and risks from a case study 89 Regulatory compliance 90 Copyright Act 1968 (Cwlth) 91 The Essential Eight 92 Essential Eight: patching applications and operating systems 93 Essential Eight: restricting administrative privileges 94 Essential Eight: application control and multi-factor authentication 95 Essential Eight: regular backups 96 Information Security Manual (ISM) 97 ISM Guidelines for Software Development 98 ISM guideline: encryption 99 Privacy Act 1988 (Cwlth) 100 Australian Privacy Principle 1 101 Australian Privacy Principle 6 102 APP 8: sending personal data overseas 103 APP 9: adoption, use or disclosure of government related identifiers 104 Australian Privacy Principle 11 105 Privacy and Data Protection Act 2014 (Vic) 106 IPP 1: collection of personal information 107 Information Privacy Principle 2 108 Information Privacy Principle 4 109 Information Privacy Principle 5 110 IPP 9: transborder data flows 111 Applying privacy principles to a software development scenario 112 Ethical issue: ineffective security practices 113 Emerging trend: AI code generation tools 114 Checking and testing AI-generated code 115 Protecting privacy and confidential code when using AI tools 116 Bias and over-reliance when using AI to program 117 Australia’s Artificial Intelligence (AI) Ethics Principles 118 Intellectual property in software you write 119 Software licences and open-source code 120 Acknowledging sources and copyright 121 Ethical issue: copyright when using third-party and AI-generated code 122 Legal and ethical consequences of ineffective software development practices 123 Mitigation measures for threats, vulnerabilities and risks 124 Staff procedures 125 Incident response planning 126 Onboarding and induction for secure development 127 Developer training focused on secure development 128 A risk management plan for software development 129 A risk register: likelihood, impact and response 130 Recommending and justifying improvements to development practices

8

VCE Software Development U4O2: Organisational goals and in-house vs external development Students learn the goals and objectives of medium and large organisations and weigh the advantages and disadvantages of developing software in-house or externally.

13

VCE Software Development U4O2: Cyber security foundations Students learn the core security vocabulary of assets, threats, vulnerabilities, risk and the confidentiality, integrity and availability of data, including incidents and breaches.

17

VCE Software Development U4O2: Vulnerabilities and risks in insecure development environments Students learn how insecure environments, APIs, malware, unpatched software, poor access management, man-in-the-middle attacks and insider threats put code and data at risk.

9

VCE Software Development U4O2: Third-party software, code review and combined environments Students learn the risks from supply chains, third-party software, ineffective code review and development, testing and production environments that are combined.

23

VCE Software Development U4O2: Security controls for development practices and stored data Students learn the controls that protect development and application data: version control, identity and access management, encryption, code review, patching, separated environments and supply chain protections.

18

VCE Software Development U4O2: Threat modelling and evaluating security practices Students learn to define security requirements, identify and mitigate threats, confirm the mitigation worked, and evaluate an organisation's development practices against criteria using case-study evidence.

10

VCE Software Development U4O2: Copyright, Essential Eight and the ISM Students learn how regulatory compliance, the Copyright Act, the Essential Eight and the ISM Guidelines for Software Development shape secure development.

13

VCE Software Development U4O2: Privacy legislation Students learn the Australian Privacy Principles and the Victorian Information Privacy Principles that govern how personal information is collected, used, protected and sent elsewhere, and apply them to development scenarios.

11

VCE Software Development U4O2: Ethical issues in software development Students learn the ethical issues of ineffective security, AI use in development, intellectual property and copyright, and the legal and ethical consequences of poor practice.

8

VCE Software Development U4O2: Mitigation and improving secure development practices Students learn mitigation measures and strategies such as staff procedures, incident response, onboarding, developer training and risk management plans, and how to recommend and justify improvements.

✎

VCE Innovative Solutions Crossword: Gantt Charts and Project Management and more (Part 2 of 2) 10 clues · Gantt Charts and Project Management, Design Tool - Mock-ups, Design Tool - Storyboards, Design Tool - Sitemap and more

🔎

VCE Innovative Solutions Word Search: Impact of Emerging Trends in Digital Systems and more (All modules) 20 words to find · Impact of Emerging Trends in Digital Systems, Characteristics of Creative and Innovative Solutions, Functions and Capabilities of Digital Systems, Ideation Techniques and more

✎

VCE Cyber Security Crossword: Emerging trends in cyber security to Antivirus software (Modules 1–10) 10 clues · Emerging trends in cyber security, Regulatory compliance, Zero Trust Architecture, Routers and more

✎

VCE Cyber Security Crossword: Local Area Networks (LANs) to Viruses (Modules 21–30) 10 clues · Local Area Networks (LANs), Wide Area Networks (WANs), Wireless Personal Area Networks (WPANs), Global exposure to cyber security threats and more

✎

VCE Cyber Security Crossword: Worms to Operating system updates (Modules 31–40) 10 clues · Worms, Ransomware, Denial of service attacks, Improper credential management and more

✎

VCE Cyber Security Crossword: Software malware updates to RSA (Modules 41–50) 10 clues · Software malware updates, Staff procedures, Encryption and decryption, Caesar cipher and more

✎

VCE Cyber Security Crossword: ECDH to ISM guideline: network access controls (Modules 51–60) 10 clues · ECDH, ECDSA, Machine learning analysis of network traffic, Real-time monitoring and notification and more

✎

VCE Cyber Security Crossword: ISM guideline: confidentiality and integrity of wireless traffic and more (Modules 61–74) 10 clues · ISM guideline: confidentiality and integrity of wireless traffic, ISM guideline: wireless network footprint, Privacy Act 1988 (Cwlth), Australian Privacy Principle 1 and more

🔎

VCE Cyber Security Word Search: Emerging trends in cyber security and more (Modules 1–20) 20 words to find · Emerging trends in cyber security, Regulatory compliance, Zero Trust Architecture, Routers and more

🔎

VCE Cyber Security Word Search: Local Area Networks (LANs) to Operating system updates (Modules 21–40) 20 words to find · Local Area Networks (LANs), Wide Area Networks (WANs), Wireless Personal Area Networks (WPANs), Global exposure to cyber security threats and more

🔎

VCE Cyber Security Word Search: Software malware updates to Information Privacy Principle 5 (Modules 41–74) 22 words to find · Software malware updates, Staff procedures, Encryption and decryption, Caesar cipher and more

✎

Issues in Technology Crossword: Is AI using too much power? and more (Part 1 of 2) 10 clues · Is AI using too much power?, How does an AI actually work?, Compression - losing quality or saving space?, Why file size matters and more

🔎

Issues in Technology Word Search: Is AI using too much power? to What is RADCAB? (All modules) 22 words to find · Is AI using too much power?, How does an AI actually work?, Compression - losing quality or saving space?, Why file size matters and more

✎

Years 7–8 Digital Systems Crossword: Data transmission and network security and Account security and cyber threats (Modules 26–74) 10 clues · Comparing wired and wireless networks, Wi-Fi range and interference, HTTPS and the padlock, Securing a Wi-Fi network and more

🔎

Years 7–8 Digital Systems Word Search: Hardware for particular tasks to Account security and cyber threats (Modules 4–74) 20 words to find · CPU clock speed (GHz), CPU cores, HDD vs SSD performance, Storage units: KB, MB, GB, TB and more

✎

Years 9–10 Digital Systems Crossword: Controlling and securing access to data (Modules 13–24) 10 clues · Confidentiality, Integrity, Availability, Authentication vs authorisation and more

✎

Years 9–10 Digital Systems Crossword: Controlling and securing access to data and Threats and software vulnerabilities (Modules 25–40) 10 clues · Salting a password hash, Brute-force and dictionary attacks, Asset, Threat and more

✎

Years 9–10 Digital Systems Crossword: Threats and software vulnerabilities to Software supply chain vulnerabilities (Modules 41–69) 10 clues · SQL injection, Buffer overflow, Zero-day vulnerabilities, Insider threats and human error and more

✎

Years 9–10 Digital Systems Crossword: Software supply chain vulnerabilities and Threat modelling and security responses (Modules 70–79) 10 clues · Reducing supply chain risk, Risk as likelihood and impact, Risk rating matrix, Data flow diagram of a system and more

🔎

Years 9–10 Digital Systems Word Search: Controlling and securing access to data and Threats and software vulnerabilities (Modules 13–40) 20 words to find · Confidentiality, Integrity, Availability, Authentication vs authorisation and more

🔎

Years 9–10 Digital Systems Word Search: Threats and software vulnerabilities to Threat modelling and security responses (Modules 41–79) 20 words to find · SQL injection, Buffer overflow, Zero-day vulnerabilities, Insider threats and human error and more

✎

VCE Data Analysis Crossword: Ethics and APA referencing and Requirements, constraints and scope (Modules 56–67) 10 clues · Acknowledging sources and copyright, Purpose of APA referencing, APA in-text citations, APA reference list entry structure and more

🔎

VCE Data Analysis Word Search: Ethics and APA referencing to Design tools for databases, spreadsheets and visualisations (Modules 56–80) 22 words to find · Acknowledging sources and copyright, Purpose of APA referencing, APA in-text citations, APA reference list entry structure and more

✎

VCE Software Development U3O1 Crossword: Testing modules and Artificial intelligence in programming (Modules 178–193) 10 clues · Testing one module in isolation, Modifying an existing program, Emerging trend: AI code generation tools, Writing a prompt to generate code and more

🔎

VCE Software Development U3O1 Word Search: Errors and debugging to Artificial intelligence in programming (Modules 168–193) 20 words to find · Debugging a program with print() and trace tables, Setting a breakpoint, Stepping through code and watching variables, Tracing nested loops and more

✎

VCE Software Development U3O2 Crossword: Analytical tools and the software requirements specification and Legal requirements for copyright, ownership and privacy (Modules 52–71) 10 clues · Purpose of a software requirements specification (SRS), SRS content: requirements, constraints and scope, SRS content: user characteristics and technical environment, SRS content: analytical tools depicting existing systems and more

✎

VCE Software Development U3O2 Crossword: Legal requirements for copyright, ownership and privacy to Ideation and evaluating design ideas (Modules 72–85) 10 clues · IPP 10: sensitive information, File naming, shared folders and version history, Version control for software projects, Full backup and more

🔎

VCE Software Development U3O2 Word Search: Analytical tools and the software requirements specification to Ideation and evaluating design ideas (Modules 52–85) 20 words to find · Purpose of a software requirements specification (SRS), SRS content: requirements, constraints and scope, SRS content: user characteristics and technical environment, SRS content: analytical tools depicting existing systems and more

✎

Crossword: Organisational goals and in-house vs external development to Vulnerabilities and risks in insecure development environments (Modules 1–22) 10 clues · Goals and objectives of medium and large organisations, Security as an organisational objective, Medium and large organisations compared, In-house development: advantages and more

✎

Crossword: Vulnerabilities and risks in insecure development environments and Third-party software, code review and combined environments (Modules 23–47) 10 clues · What makes a development environment insecure, What an API is, Risks of using APIs, Hard-coded API keys and secrets and more

✎

Crossword: Security controls for development practices and stored data and Threat modelling and evaluating security practices (Modules 49–72) 10 clues · Code repositories, Securing a code repository, Encrypting data at rest and in transit, Peer code review process and more

✎

Crossword: Threat modelling and evaluating security practices and Copyright, Essential Eight and the ISM (Modules 81–95) 10 clues · Identifying and mitigating threats, Confirming threats have been mitigated, Criteria for evaluating the security of software development practices, Rating a practice against a criterion with evidence and more

✎

Crossword: Copyright, Essential Eight and the ISM to Mitigation and improving secure development practices (Modules 97–130) 10 clues · ISM Guidelines for Software Development, Applying privacy principles to a software development scenario, Ethical issue: ineffective security practices, Intellectual property in software you write and more

🔎

Word Search: Organisational goals and in-house vs external development to Third-party software, code review and combined environments (Modules 1–47) 20 words to find · Goals and objectives of medium and large organisations, Security as an organisational objective, Medium and large organisations compared, In-house development: advantages and more

🔎

Word Search: Security controls for development practices and stored data to Mitigation and improving secure development practices (Modules 49–130) 20 words to find · Code repositories, Securing a code repository, Encrypting data at rest and in transit, Peer code review process and more