VCE Software Development U4O2 Crossword: Vulnerabilities and risks in insecure development environments and Third-party software, code review and combined environments (Modules 23–47)
Name:
Date:
Class:
✎
Crossword
Read each clue and write the matching term in the grid. Numbers in brackets show the letters in each word.
1
2
3
4
5
6
7
8
9
10
Across
- 3. An API is risky when it lacks authentication, input validation or rate limits, so attackers can send requests straight to it and steal data or misuse it. Word 3 of: API security ____ (4)
- 6. Risk from software bought, outsourced or downloaded, as you cannot fully see or control how it was built and maintained (poor code, backdoors, no support, licence issues). Word 1 of: _____-_____ ________ ____ (5)
- 7. Word 1 of the term in 1 Down: ____-coded ______ (4)
- 9. Weak control of accounts, permissions and logins, such as shared accounts or no MFA, so the wrong people or systems can reach code and data. Word 5 of: Poor identity and access __________ (10)
- 10. Word 1 of the term in 4 Down: _________ ________ (9)
Down
- 1. A key, password or token written directly into source code. Anyone who can read the code or its repository can steal it, and deleting the file later does not remove it from the history. Word 3 of: ____-coded ______ (6)
- 2. A workspace where weak controls over people, tools, code and data let vulnerabilities enter the software or let attackers reach it. Word 3 of: insecure development ___________ (11)
- 4. ______ missing security updates, so known flaws stay open. In a dev environment, attackers can use them on developer machines or build servers to reach code and data. Word 2 of: _________ ________ (8)
- 5. An attack where someone secretly sits between two parties and can read or change the data passing between them, such as logins, session tokens or code sent over an unsecured network. Word 4 of: man-in-the-______ attack (6)
- 8. Word 2 of the term in 6 Across: _____-_____ ________ ____ (5)
Answer Key
VCE Software Development U4O2 · Modules 23–47
1S
E
C
2E
3R
I
4S
K
N
E
O
V
T
F
5M
I
6T
H
I
R
D
R
W
D
O
7H
A
R
D
N
8P
R
L
9M
A
N
A
G
E
M
E
N
T
E
R
10U
N
P
A
T
C
H
E
D
T
Y
Across
3RISK — An API is risky when it lacks authentication, input validation or rate limits, so attackers can send requests straight to it and steal data or misuse it. Word 3 of: API security ____
6THIRD — Risk from software bought, outsourced or downloaded, as you cannot fully see or control how it was built and maintained (poor code, backdoors, no support, licence issues). Word 1 of: _____-_____ ________ ____
7HARD — Word 1 of the term in 1 Down: ____-coded ______
9MANAGEMENT — Weak control of accounts, permissions and logins, such as shared accounts or no MFA, so the wrong people or systems can reach code and data. Word 5 of: Poor identity and access __________
10UNPATCHED — Word 1 of the term in 4 Down: _________ ________
Down
1SECRET — A key, password or token written directly into source code. Anyone who can read the code or its repository can steal it, and deleting the file later does not remove it from the history. Word 3 of: ____-coded ______
2ENVIRONMENT — A workspace where weak controls over people, tools, code and data let vulnerabilities enter the software or let attackers reach it. Word 3 of: insecure development ___________
4SOFTWARE — ______ missing security updates, so known flaws stay open. In a dev environment, attackers can use them on developer machines or build servers to reach code and data. Word 2 of: _________ ________
5MIDDLE — An attack where someone secretly sits between two parties and can read or change the data passing between them, such as logins, session tokens or code sent over an unsecured network. Word 4 of: man-in-the-______ attack
8PARTY — Word 2 of the term in 6 Across: _____-_____ ________ ____