Criteria for evaluating the security of software development practices
Name:
Date:
Class:
A
Quick Questions
Shade in the A or B circle for each question.
1. Which is the better evaluation criterion for judging a development team's security?
2. What is the purpose of evaluation criteria?
3. Choosing relevant criteria: a team stores customer data in a database. Which criterion is most relevant?
4. Which statement describes judging the effectiveness of a control?
5. Which criterion tests compliance with legislation?
B
Match the Pairs
Draw a line connecting each item on the left to its match on the right.
| Left column | Right column | |
|---|---|---|
| 1Criterion: Patching - critical patches applied within 48 hours | ACoverage = threats with a tested control / total threats | |
| 2Criterion: Compliance - meets APP 11 and Essential Eight | BThe criterion is vague and not measurable. It gives no standard to judge against, so it cannot be used to evaluate security. It should be measurable, such as: 100% of developers complete secure coding training each year. | |
| 3Choosing relevant criteria: pick standards that match the threats found, such as SQL injection in a web app | CA measurable criterion that judges how effective an organisation's patch management is, using a clear time target. | |
| 4Coverage of threats found: check each threat in the threat model has a control that is judged by a criterion | DThe criteria are not relevant to the threats found and do not cover them. Criteria should be chosen from the threats identified, such as access control, patching and environment separation. | |
| 5Criterion: Our developers are pretty careful | EA criterion that judges whether practices follow legislation and frameworks the organisation must meet. | |
| 6Criteria: Staff training only (ignore threats found) | FCriterion: Code review - 100% of merges peer reviewed |
C
Definitions
evaluation criteria
D
Fill in the Blanks
Complete each line of code by filling in the missing parts.
1.
FOR EACH criterion __ criteria
OUTPUT criterion
END FOR
2.
IF coverage __ 80 THEN
OUTPUT "Criterion met"
END IF
3.
mitigated ← 8
total ← 10
coverage ← mitigated _ total * 100
4.
IF compliant ___ effective THEN
OUTPUT "Practice is secure"
END IF
5.
IF patched = FALSE THEN
______ "Patching gap found"
END IF
E
Spot the Error
Shade in the letter of the line that contains an error.
Question 1
A
patched = 45
B
total = 0
C
rate = patched / total * 100
D
print("Patch rate:", rate)
Question 2
A
found = 10
B
covered = 8
C
cov = found / covered * 100
D
print("Coverage:", cov)
Question 3
A
passed = ["access", "review"]
B
required = 2
C
met = len(passed)
D
if met > required:
E
print("Meets standard")
Question 4
A
ok = {"MFA": 1, "Logs": 0}
B
for name in ok
C
if ok[name]:
D
print(name, "passed")
Question 5
A
w = {"access": 3, "MFA": 1
B
total = 0
C
for k in w:
D
total += w[k]
Answer Key
Criteria for evaluating the security of software development practices
Section A: Quick Questions
Q1
B — Percentage of critical patches applied within 14 days
Q2
A — To judge how effective and compliant security practices are against a measurable standard
Q3
A — Access control: only authorised roles can read the customer data
Q4
B — Checking how well code review catches vulnerabilities before release
Q5
A — Personal information is protected as required by the Australian Privacy Principles
Section B: Match the Pairs
Q1
Criterion: Patching - critical patches applied within 48 hours → A measurable criterion that judges how effective an organisation's patch management is, using a clear time target.
Q2
Criterion: Compliance - meets APP 11 and Essential Eight → A criterion that judges whether practices follow legislation and frameworks the organisation must meet.
Q3
Choosing relevant criteria: pick standards that match the threats found, such as SQL injection in a web app → Criterion: Code review - 100% of merges peer reviewed
Q4
Coverage of threats found: check each threat in the threat model has a control that is judged by a criterion → Coverage = threats with a tested control / total threats
Q5
Criterion: Our developers are pretty careful → The criterion is vague and not measurable. It gives no standard to judge against, so it cannot be used to evaluate security. It should be measurable, such as: 100% of developers complete secure coding training each year.
Q6
Criteria: Staff training only (ignore threats found) → The criteria are not relevant to the threats found and do not cover them. Criteria should be chosen from the threats identified, such as access control, patching and environment separation.
Section C: Definitions
Q1
evaluation criteria — Measurable standards, such as access control, code review, patching and training, used to judge how effective and compliant an organisation's development practices are.Section D: Fill in the Blanks
Q1
FOR EACH criterion IN criteria
OUTPUT criterion
END FORQ2
IF coverage >= 80 THEN
OUTPUT "Criterion met"
END IFQ3
mitigated ← 8
total ← 10
coverage ← mitigated / total * 100Q4
IF compliant AND effective THEN
OUTPUT "Practice is secure"
END IFQ5
IF patched = FALSE THEN
OUTPUT "Patching gap found"
END IFSection E: Spot the Error
Q1
B — The total number of systems must be 50 so the patching rate can be measured. A total of 0 causes a divide-by-zero error. It should be total = 50.
Q2
C — Coverage of threats found is the threats covered divided by the threats found. The division is swapped. It should be covered / found * 100.
Q3
D — A practice meets the standard when it meets at least the required number of criteria. Using > wrongly fails it when the numbers are equal. It should be >=.
Q4
B — A for loop header must end with a colon. Without it the program has a syntax error and no criteria are checked. It should be for name in ok:
Q5
A — The dictionary of criteria weights is missing its closing brace, which is a syntax error. The line should end with }.