Analysing an organisation's software development practices

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. When analysing a case study, which approach is the best first step?

A Immediately list every possible cyber attack that exists, whether or not it relates to the organisation

B Describe how the organisation builds software: who is involved, which environments and tools it uses, and which controls it has

2. Which detail from a case study is about PEOPLE?

A Two contract developers have admin access to the production server

B Code is stored in a cloud repository with branch protection

3. Which detail from a case study is about PROCESS?

A The team uses an automated code analysis tool on a build server

B Every change must be peer reviewed by a second developer before it is merged

4. Which detail from a case study is about TECHNOLOGY?

A The application is hosted on a cloud server and uses a third-party payment API

B New staff attend a half-day induction in their first week

5. A case study says all developers must use multi-factor authentication to access the code repository. How should you classify this?

A A current control that protects the repository

B A gap or weakness in the organisation's practices

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1People, process, technology		AThis jumps to a recommendation without first describing the people, process, technology or current controls in the case study.
2Current controls		BThis ignores the current controls stated in the case study and makes a claim the evidence does not support.
3Describing the process: the case study says developers push code straight to production without a peer review step.		CControl: MFA for admins \| Gap: none for developers
4Spotting a gap: a control exists for some staff or systems but not for others in the case study.		DThe security measures the organisation already uses, such as MFA, code review, access logs or separate environments, as stated in the case study.
5Analysis: 'The company should buy a firewall.'		EProcess: commit -> deploy to production (no review)
6Controls: 'The company has no security.' (case study mentions code review and MFA)		FThree lenses for describing how an organisation builds software: who is involved, the steps they follow and the tools or environments they use.

Definitions

Analysing a case study

Fill in the Blanks

Complete each line of code by filling in the missing parts.

______: developers, testers, security lead

Process: every change gets a ___________

Environments: dev, test, __________

Control: ___ on the code repository login

Gap: secrets hard-coded in ___________

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A People: 4 in-house developers

B Gap: peer code review

C Gap: reviews are optional

Question 2

A Process: 2-week sprints

B Tech: GitHub, Jenkins, AWS

C Control: no MFA on GitHub

Question 3

A Tech: Python, Git, AWS

B Tech: 2 testers, 1 manager

C Gap: no security training

Question 4

A People: weekly code reviews

B Tech: GitHub pull requests

C Control: two approvals needed

Question 5

A Control: no code is reviewed

B Evidence: PR approval history

C Rating: effective

Answer Key

Analysing an organisation's software development practices

Section A: Quick Questions

B — Describe how the organisation builds software: who is involved, which environments and tools it uses, and which controls it has

A — Two contract developers have admin access to the production server

B — Every change must be peer reviewed by a second developer before it is merged

A — The application is hosted on a cloud server and uses a third-party payment API

A — A current control that protects the repository

Section B: Match the Pairs

People, process, technology → Three lenses for describing how an organisation builds software: who is involved, the steps they follow and the tools or environments they use.

Current controls → The security measures the organisation already uses, such as MFA, code review, access logs or separate environments, as stated in the case study.

Describing the process: the case study says developers push code straight to production without a peer review step. → Process: commit -> deploy to production (no review)

Spotting a gap: a control exists for some staff or systems but not for others in the case study. → Control: MFA for admins | Gap: none for developers

Analysis: 'The company should buy a firewall.' → This jumps to a recommendation without first describing the people, process, technology or current controls in the case study.

Controls: 'The company has no security.' (case study mentions code review and MFA) → This ignores the current controls stated in the case study and makes a claim the evidence does not support.

Section C: Definitions

Analysing a case study — Describe how the organisation builds software: who is involved, which environments and tools it uses, and which security controls it has, then spot gaps.

Section D: Fill in the Blanks

People: developers, testers, security lead

Process: every change gets a code review

Environments: dev, test, production

Control: MFA on the code repository login

Gap: secrets hard-coded in source code

Section E: Spot the Error

B — Peer code review is a control the organisation already has, so it belongs under Control. The gap is that reviews are optional, as line 3 says.

C — A missing MFA protection is a weakness, not a current control. It should be recorded as 'Gap: no MFA on GitHub'.

B — Testers and managers are people involved in development, not technology. The line should start with 'People:'.

A — Weekly code reviews describe how work is done, so they are part of the process. The label should be 'Process:'.

A — The evidence shows pull request approvals and the rating is effective, so the control is that all code is reviewed. 'No code is reviewed' contradicts both lines.