← VCE Software Development U4O2

Analysing an organisation's software development practices

Describe how the organisation builds software: who is involved, which environments and tools it uses, and which security controls it has, then spot gaps.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 87

Understanding Analysing an organisation's software development practices in VCE Software Development U4O2

What it does: The code shows the process as the case study states it, including the missing review step that will become a gap. Comparing the current control with who it covers reveals the gap or weakness in the organisation's practice. Start by describing the organisation's current practices (people, process and technology). Only then can you spot gaps that relate to this organisation. People covers who is involved and what access or training they have. Where code is stored is a technology detail. A process is a set steps or procedure the team follows, such as peer review before merging. The analysis tool itself is technology.

Common mistakes: Peer code review is a control the organisation already has, so it belongs under Control. The gap is that reviews are optional, as line 3 says. A missing MFA protection is a weakness, not a current control. It should be recorded as 'Gap: no MFA on GitHub'.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Analysing an organisation's software development practices to a class →

This module's key terms are also in a printable crossword (Modules 81–95) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
When analysing a case study, which approach is the best first step?
Describe how the organisation builds software: who is involved, which environments and tools it uses, and which controls it hasImmediately list every possible cyber attack that exists, whether or not it relates to the organisation
Matches
Analysis: 'The company should buy a firewall.'
↓
This jumps to a recommendation without first describing the people, process, technology or current controls in the case study.
Applying
Meanings
Term
Analysing a case study
Meaning
Describe how the organisation builds software: who is involved, which environments and tools it uses, and which security controls it has, then spot gaps.
Practice
People: 4 developers, 1 tester
Testing
Gaps
: developers, testers, security lead
Check Answer
Spots
1People: 4 in-house developers
2Gap: peer code review

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Seal' badge — Smooth Formatter, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. When analysing a case study, which approach is the best first step?
A. Immediately list every possible cyber attack that exists, whether or not it relates to the organisation
B. Describe how the organisation builds software: who is involved, which environments and tools it uses, and which controls it has ✓
Start by describing the organisation's current practices (people, process and technology). Only then can you spot gaps that relate to this organisation.
2. Which detail from a case study is about PEOPLE?
A. Two contract developers have admin access to the production server ✓
B. Code is stored in a cloud repository with branch protection
People covers who is involved and what access or training they have. Where code is stored is a technology detail.
3. Which detail from a case study is about PROCESS?
A. The team uses an automated code analysis tool on a build server
B. Every change must be peer reviewed by a second developer before it is merged ✓
A process is a set steps or procedure the team follows, such as peer review before merging. The analysis tool itself is technology.
4. Which detail from a case study is about TECHNOLOGY?
A. The application is hosted on a cloud server and uses a third-party payment API ✓
B. New staff attend a half-day induction in their first week
Technology covers the tools, platforms, hardware and services used. Staff induction is a people or process detail.
5. A case study says all developers must use multi-factor authentication to access the code repository. How should you classify this?
A. A current control that protects the repository ✓
B. A gap or weakness in the organisation's practices
Requiring MFA is an existing security control. It helps protect the repository even if a password is stolen.

Match the Pairs

People, process, technology → Three lenses for describing how an organisation builds software: who is involved, the steps they follow and the tools or environments they use.
Current controls → The security measures the organisation already uses, such as MFA, code review, access logs or separate environments, as stated in the case study.
Describing the process: the case study says developers push code straight to production without a peer review step. → Process: commit -> deploy to production (no review)
Spotting a gap: a control exists for some staff or systems but not for others in the case study. → Control: MFA for admins | Gap: none for developers
Analysis: 'The company should buy a firewall.' → This jumps to a recommendation without first describing the people, process, technology or current controls in the case study.
Controls: 'The company has no security.' (case study mentions code review and MFA) → This ignores the current controls stated in the case study and makes a claim the evidence does not support.

Key Term

Analysing a case study
Describe how the organisation builds software: who is involved, which environments and tools it uses, and which security controls it has, then spot gaps.

Fill in the Blanks

1. People: developers, testers, security lead
Hint: Type the category label for who is involved in building the software.
2. Process: every change gets a code review
Hint: Type the process step where another developer checks a change before it is merged.
3. Environments: dev, test, production
Hint: Type the name of the environment where real users run the finished software.
4. Control: MFA on the code repository login
Hint: Type the abbreviation for the control that asks for a second proof of identity.
5. Gap: secrets hard-coded in source code
Hint: Type where the secrets are stored insecurely, which is a weakness to report in the analysis.

Spot the Error

Question 1
A People: 4 in-house developers
B Gap: peer code review
C Gap: reviews are optional
Line B — Peer code review is a control the organisation already has, so it belongs under Control. The gap is that reviews are optional, as line 3 says.
Question 2
A Process: 2-week sprints
B Tech: GitHub, Jenkins, AWS
C Control: no MFA on GitHub
Line C — A missing MFA protection is a weakness, not a current control. It should be recorded as 'Gap: no MFA on GitHub'.
Question 3
A Tech: Python, Git, AWS
B Tech: 2 testers, 1 manager
C Gap: no security training
Line B — Testers and managers are people involved in development, not technology. The line should start with 'People:'.
Question 4
A People: weekly code reviews
B Tech: GitHub pull requests
C Control: two approvals needed
Line A — Weekly code reviews describe how work is done, so they are part of the process. The label should be 'Process:'.
Question 5
A Control: no code is reviewed
B Evidence: PR approval history
C Rating: effective
Line A — The evidence shows pull request approvals and the rating is effective, so the control is that all code is reviewed. 'No code is reviewed' contradicts both lines.

Student with a class code? Join your class →