← VCE Software Development U4O2

Criteria for evaluating the security of software development practices

Measurable standards, such as access control, code review, patching and training, used to judge how effective and compliant an organisation's development practices are.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 85

Understanding Criteria for evaluating the security of software development practices in VCE Software Development U4O2

What it does: A code review criterion is relevant to threats like SQL injection because reviews catch unsafe input handling before release. This calculation measures how many of the identified threats are covered by a control that has been evaluated. A criterion must be measurable and linked to security. Patch timeliness can be measured and shows how well vulnerabilities are managed. Criteria are the standards used to judge practices. They do not replace controls, they test how well the controls work. Effectiveness is about results. A policy that exists but does not catch vulnerabilities is not effective. Compliance criteria are based on laws and frameworks, such as the Privacy Act 1988 or the Essential Eight.

Common mistakes: The total number of systems must be 50 so the patching rate can be measured. A total of 0 causes a divide-by-zero error. It should be total = 50. Coverage of threats found is the threats covered divided by the threats found. The division is swapped. It should be covered / found * 100.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Criteria for evaluating the security of software development practices to a class →

This module's key terms are also in a printable crossword (Modules 81–95) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which is the better evaluation criterion for judging a development team's security?

Percentage of critical patches applied within 14 daysHow many developers the team has

Matches

Criterion: Our developers are pretty careful

↓

The criterion is vague and not measurable. It gives no standard to judge against, so it cannot be used to evaluate security. It should be measurable, such as: 100% of developers complete secure coding training each year.

Applying

Meanings

Term

evaluation criteria

Meaning

Measurable standards, such as access control, code review, patching and training, used to judge how effective and compliant an organisation's development practices are.

Practice

EVALUATE practice: Code review

Testing

Gaps

FOR EACH criterion criteria

Check Answer

Spots

1patched = 45

2total = 0

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which is the better evaluation criterion for judging a development team's security?

A. How many developers the team has

B. Percentage of critical patches applied within 14 days ✓

A criterion must be measurable and linked to security. Patch timeliness can be measured and shows how well vulnerabilities are managed.

2. What is the purpose of evaluation criteria?

A. To judge how effective and compliant security practices are against a measurable standard ✓

B. To replace the need for any security controls

Criteria are the standards used to judge practices. They do not replace controls, they test how well the controls work.

3. Choosing relevant criteria: a team stores customer data in a database. Which criterion is most relevant?

A. Access control: only authorised roles can read the customer data ✓

B. The colour scheme used in the user interface

Relevant criteria match the assets and threats involved. Customer data is an asset, so access control is a relevant criterion.

4. Which statement describes judging the effectiveness of a control?

A. Checking that a code review policy document exists

B. Checking how well code review catches vulnerabilities before release ✓

Effectiveness is about results. A policy that exists but does not catch vulnerabilities is not effective.

5. Which criterion tests compliance with legislation?

A. Personal information is protected as required by the Australian Privacy Principles ✓

B. The team prefers to use the newest programming language

Compliance criteria are based on laws and frameworks, such as the Privacy Act 1988 or the Essential Eight.

Match the Pairs

Criterion: Patching - critical patches applied within 48 hours → A measurable criterion that judges how effective an organisation's patch management is, using a clear time target.

Criterion: Compliance - meets APP 11 and Essential Eight → A criterion that judges whether practices follow legislation and frameworks the organisation must meet.

Choosing relevant criteria: pick standards that match the threats found, such as SQL injection in a web app → Criterion: Code review - 100% of merges peer reviewed

Coverage of threats found: check each threat in the threat model has a control that is judged by a criterion → Coverage = threats with a tested control / total threats

Criterion: Our developers are pretty careful → The criterion is vague and not measurable. It gives no standard to judge against, so it cannot be used to evaluate security. It should be measurable, such as: 100% of developers complete secure coding training each year.

Criteria: Staff training only (ignore threats found) → The criteria are not relevant to the threats found and do not cover them. Criteria should be chosen from the threats identified, such as access control, patching and environment separation.

Key Term

evaluation criteria

Measurable standards, such as access control, code review, patching and training, used to judge how effective and compliant an organisation's development practices are.

Fill in the Blanks

1. FOR EACH criterion IN criteria OUTPUT criterion END FOR

Hint: Type the keyword that links each single criterion to the list of criteria being looped through.

2. IF coverage >= 80 THEN OUTPUT "Criterion met" END IF

Hint: Type the comparison operator that checks whether coverage is at least the target standard.

3. mitigated ← 8 total ← 10 coverage ← mitigated / total * 100

Hint: Type the arithmetic operator that divides threats mitigated by total threats found to give coverage.

4. IF compliant AND effective THEN OUTPUT "Practice is secure" END IF

Hint: Type the logical operator that requires both compliance and effectiveness to be true.

5. IF patched = FALSE THEN OUTPUT "Patching gap found" END IF

Hint: Type the pseudocode keyword that displays a message when a criterion is not met.

Spot the Error

Question 1

A patched = 45

B total = 0

C rate = patched / total * 100

D print("Patch rate:", rate)

Line B — The total number of systems must be 50 so the patching rate can be measured. A total of 0 causes a divide-by-zero error. It should be total = 50.

Question 2

A found = 10

B covered = 8

C cov = found / covered * 100

D print("Coverage:", cov)

Line C — Coverage of threats found is the threats covered divided by the threats found. The division is swapped. It should be covered / found * 100.

Question 3

A passed = ["access", "review"]

B required = 2

C met = len(passed)

D if met > required:

E print("Meets standard")

Line D — A practice meets the standard when it meets at least the required number of criteria. Using > wrongly fails it when the numbers are equal. It should be >=.

Question 4

A ok = {"MFA": 1, "Logs": 0}

B for name in ok

C if ok[name]:

D print(name, "passed")

Line B — A for loop header must end with a colon. Without it the program has a syntax error and no criteria are checked. It should be for name in ok:

Question 5

A w = {"access": 3, "MFA": 1

B total = 0

C for k in w:

D total += w[k]

Line A — The dictionary of criteria weights is missing its closing brace, which is a syntax error. The line should end with }.

Student with a class code? Join your class →