← VCE Software Development U4O2

Defining security requirements

A statement of the protection a system must provide for its data and functions, based on its assets, users and laws, written so it can be tested.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 72, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 51

Understanding Defining security requirements in VCE Software Development U4O2

What it does: The requirement links a protection (role-based access) to the law it comes from, showing how laws shape security requirements. The numbers (5 attempts, 15 minutes) let a tester try it and see a clear pass or fail result, which makes the requirement testable. Confidentiality limits who can see data. Staying online 99.9% of the time is an availability requirement. Good requirements are precise and measurable. 'Good' and 'safe' are vague, so a tester cannot check them. A security requirement must name what is protected and state a testable condition, for example encrypting named data with a named standard.

Common mistakes: The requirement limits who can view the marks, so it is a confidentiality requirement. It should be TYPE: confidentiality. Protecting customer personal data falls under the Privacy Act 1988 (Cwlth), not the Copyright Act. The line should be LAW: Privacy Act 1988 (Cwlth).

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Defining security requirements to a class →

This module's key terms are also in a printable crossword (Modules 49–72) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which is a testable security requirement?
The system must lock an account for 15 minutes after 5 failed login attempts.The system must be very secure against hackers.
Matches
The system shall be very secure and protect all data well.
↓
It is vague and not measurable. Words like 'very secure' and 'well' cannot be tested, and no asset or control is named.
Applying
Meanings
Term
security requirement
Meaning
A statement of the protection a system must provide for its data and functions, based on its assets, users and laws, written so it can be tested.
Practice
Asset: student marks
Testing
Gaps
need:
Check Answer
Spots
1ASSET: student marks table
2TYPE: availability

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Peregrine Falcon' badge — Operator Ace, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which is a testable security requirement?
A. The system must lock an account for 15 minutes after 5 failed login attempts. ✓
B. The system must be very secure against hackers.
A testable requirement is specific and measurable, so a tester can check it passes or fails. 'Very secure' cannot be tested.
2. What does a security requirement state?
A. The programming language the developers must use
B. The protection a system must provide for its data and functions ✓
A security requirement describes the protection needed for the data and functions. It does not choose the tools used to build the system.
3. Which requirement is mainly about confidentiality?
A. Only the student and their teachers can view a student's results. ✓
B. The results website must be online 99.9% of the time.
Confidentiality limits who can see data. Staying online 99.9% of the time is an availability requirement.
4. Which requirement is mainly about integrity?
A. Marks must be encrypted so unauthorised users cannot read them.
B. Any change to a mark must be logged and only allowed for authorised staff. ✓
Integrity means data is accurate and not changed without permission. Encrypting data so others cannot read it is a confidentiality requirement.
5. Which requirement is mainly about availability?
A. The booking system must recover from a failure within 30 minutes. ✓
B. The booking system must hide customers' addresses from other users.
Availability means the system and data can be used when needed, including quick recovery. Hiding addresses is confidentiality.

Match the Pairs

The system shall encrypt all student records stored in the database using AES-256. → A confidentiality requirement: it protects data so only authorised parties can read it.
The system shall be available 99.9% of the time during school terms, measured monthly. → An availability requirement: it sets a measurable level of uptime so authorised users can access the system.
A legal requirement drawn from privacy law: the system must protect personal information and only disclose it as permitted. → The system shall restrict access to personal information to staff with an approved role, in line with the Privacy Act 1988.
A testable requirement states a specific, measurable condition that a tester can check as pass or fail. → The system shall lock an account for 15 minutes after 5 failed login attempts.
The system shall be very secure and protect all data well. → It is vague and not measurable. Words like 'very secure' and 'well' cannot be tested, and no asset or control is named.
Requirement: Staff must use strong passwords. (Written without identifying the system's users, assets or laws.) → It ignores the assets, users and laws involved, so it does not say who or what is protected or why. 'Strong' is also not defined.

Key Term

security requirement
A statement of the protection a system must provide for its data and functions, based on its assets, users and laws, written so it can be tested.

Fill in the Blanks

1. asset: student health records need: confidentiality rule: Only the school nurse can view them.
Hint: Type the CIA property about letting only authorised people view data.
2. asset: exam marks need: integrity rule: Any mark change must be logged.
Hint: Type the CIA property about keeping data accurate and unaltered.
3. asset: online booking system need: availability rule: Must be online 99.9% of the time.
Hint: Type the CIA property about the system being usable when needed.
4. asset: customer personal details source: legal (Privacy Act 1988) rule: Protect data from misuse and loss.
Hint: Type the kind of requirement that comes from laws and regulations.
5. requirement: Lock account after 5 bad logins test: Enter 5 wrong passwords, check lock
Hint: Type the label for the line that says how the requirement will be checked.

Spot the Error

Question 1
A ASSET: student marks table
B TYPE: availability
C RULE: Only teachers view marks
D TEST: Student login is denied
Line B — The requirement limits who can view the marks, so it is a confidentiality requirement. It should be TYPE: confidentiality.
Question 2
A LAW: Copyright Act 1968
B ASSET: customer personal data
C REQ: Encrypt data at rest
D TEST: DB file is unreadable
Line A — Protecting customer personal data falls under the Privacy Act 1988 (Cwlth), not the Copyright Act. The line should be LAW: Privacy Act 1988 (Cwlth).
Question 3
A ASSET: order total
B TYPE: integrity
C REQ: Users can edit any total
D TEST: Edited total is rejected
Line C — An integrity requirement must stop unauthorised changes to the data. Letting users edit any total breaks it. It should say the server alone sets the total.
Question 4
A ASSET: online booking site
B TYPE: availability
C REQ: Site must be mostly up
D TEST: Monitor logs uptime
Line C — 'Mostly up' is vague and cannot be tested. A security requirement needs a measurable target such as uptime is 99.9% monthly.
Question 5
A ASSET: staff payroll file
B USER: all students and staff
C REQ: Login with MFA to view
D TEST: Login without MFA fails
Line B — The users of the asset must be identified correctly. Only payroll officers need the payroll file, so the line should be USER: payroll officers only.

Student with a class code? Join your class →