← VCE Software Development U4O2

Confirming threats have been mitigated

Retesting a control after it is applied, using code review and security tests, to prove the threat is reduced, check no new weakness exists, note residual risk and record the evidence.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 82

Understanding Confirming threats have been mitigated in VCE Software Development U4O2

What it does: Retesting the control with the original attack payload shows whether the threat is actually reduced. Recording evidence gives a traceable proof that the mitigation was verified. Residual risk is the risk left over after controls. It is checked and recorded, and the organisation decides if it is acceptable. Verification needs a test that attacks the same weakness. Looks alone do not show whether the threat is blocked. Code review is used alongside security testing. It can spot mistakes and new weaknesses introduced by the fix. Evidence should be recorded and checkable, such as test results, review notes and dates, not just opinion.

Common mistakes: The retest sends an SQL injection payload. The control works only if the login is denied. Checking for "granted" would report success when the attack got through. It should be if result == "denied":. A Python function definition must end with a colon. It should be def retest(control, attack):.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Confirming threats have been mitigated to a class →

This module's key terms are also in a printable crossword (Modules 81–95) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
After a control is applied to fix a vulnerability, what should the team do next?
Assume the threat is gone because the control was installedRetest the control to prove the threat is actually reduced
Matches
control_applied = True threat_reduced = True # assumed, not tested
↓
The team assumes the threat is reduced without retesting the control, so there is no proof it works.
Applying
Meanings
Term
Verification testing
Meaning
Retesting a control after it is applied, using code review and security tests, to prove the threat is reduced, check no new weakness exists, note residual risk and record the evidence.
Practice
BEGIN VerifyControl
Testing
Gaps
assert attackWorked ==
Check Answer
Spots
2result = login("admin", payload)
3if result == "granted":

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Chambered Nautilus' badge — File Explorer, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. After a control is applied to fix a vulnerability, what should the team do next?
A. Assume the threat is gone because the control was installed
B. Retest the control to prove the threat is actually reduced ✓
Applying a control is not proof it works. The team must retest it to confirm the threat has been reduced.
2. Which statement about residual risk is correct?
A. Some risk can remain after a control is applied, so it must be assessed and recorded ✓
B. Once a control is applied, the risk is always reduced to zero
Residual risk is the risk left over after controls. It is checked and recorded, and the organisation decides if it is acceptable.
3. A developer adds input validation to stop SQL injection. Which action best confirms the threat is mitigated?
A. Run security tests that try SQL injection inputs and check they are rejected ✓
B. Check that the login form still looks the same on screen
Verification needs a test that attacks the same weakness. Looks alone do not show whether the threat is blocked.
4. Why should a peer review the code that contains a new security control?
A. To check the control is correct and has not created a new weakness ✓
B. To avoid having to run any security tests at all
Code review is used alongside security testing. It can spot mistakes and new weaknesses introduced by the fix.
5. Which is the best evidence that a threat has been mitigated?
A. A developer's verbal comment that it should be fine now
B. A recorded test result showing the earlier attack now fails ✓
Evidence should be recorded and checkable, such as test results, review notes and dates, not just opinion.

Match the Pairs

Verification testing → Retesting a control after it is applied to prove the threat is actually reduced and no new weakness was created
Residual risk → The risk that remains after a control has been applied and tested
After adding input validation, the team re-runs the same SQL injection attack that worked before to see if it now fails → run_test("' OR 1=1 --") -> expect: rejected
The tester records the test date, result and evidence so the organisation can prove the control works → log: 2025-03-12 | SQLi retest | PASS | screenshot_14.png
control_applied = True threat_reduced = True # assumed, not tested → The team assumes the threat is reduced without retesting the control, so there is no proof it works.
retest: PASS residual_risk = None new_code_reviewed = False → The new code was not reviewed, so a new weakness may have been introduced, and residual risk was ignored instead of being recorded.

Key Term

Verification testing
Retesting a control after it is applied, using code review and security tests, to prove the threat is reduced, check no new weakness exists, note residual risk and record the evidence.

Fill in the Blanks

1. assert attackWorked == False
Hint: Type the Boolean value showing the retest attack should no longer succeed once the control is in place.
2. residual = before - removed
Hint: Type the arithmetic operator that takes the risk removed by the control away from the original risk.
3. evidence = [] evidence.append("retest passed")
Hint: Type the list method that adds a new item to the end of the evidence record.
4. if len(newIssues) > 0: print("New weakness found")
Hint: Type the comparison operator that checks whether any new weaknesses were found after the fix.
5. if reviewed and testsPassed: status = "verified"
Hint: Type the logical operator that requires both the code review and the security tests to succeed.

Spot the Error

Question 1
A payload = "' OR '1'='1"
B result = login("admin", payload)
C if result == "granted":
D print("Control works")
Line C — The retest sends an SQL injection payload. The control works only if the login is denied. Checking for "granted" would report success when the attack got through. It should be if result == "denied":.
Question 2
A def retest(control, attack)
B result = attack(control)
C return result == "blocked"
Line A — A Python function definition must end with a colon. It should be def retest(control, attack):.
Question 3
A evidence = []
B test = run_test("XSS check")
C evidence.append(test)
D print(length(evidence))
Line D — Python has no length() function. The built-in that counts the recorded evidence items is len(). It should be print(len(evidence)).
Question 4
A risk_before = 9
B risk_after == 3
C residual = risk_after
D print(residual)
Line B — A single = assigns a value. == compares values, so risk_after would never be created. The line should be risk_after = 3 so the residual risk can be recorded.
Question 5
A tests = ["login", "upload"
B for t in tests:
C print("Retesting", t)
Line A — The list is missing its closing square bracket. It should be tests = ["login", "upload"].

Student with a class code? Join your class →