VCE Software Development U4O2 Definitions Worksheet: Organisational goals and in-house vs external development to Vulnerabilities and risks in insecure development environments (Modules 1–22)
Name:
Date:
Class:
✎
Key terms
Write what each term means, in your own words.
1
organisational objective
2
security objective
3
Medium and large organisations
4
In-house development
5
In-house development disadvantages
6
External development advantages
7
External development risks
8
sourcing decision
9
cyber security incident
10
development, testing and production
Answer Key
VCE Software Development U4O2 · Modules 1–22 · Student wording will vary for definitions
1organisational objective — A measurable target, such as growth, profit, customer trust or compliance, that a medium or large organisation sets to achieve its goals and that its software must support.
2security objective — A goal to protect data and systems, because a security failure can damage an organisation's reputation, finances and ability to keep operating.
3Medium and large organisations — Organisations with more staff, bigger budgets, more systems and users, formal policies and dedicated security teams, so they manage software development and its risks more formally.
4In-house development — Software built by the organisation's own staff, giving it direct control over the code, security practices, data and developers.
5In-house development disadvantages — Building software with your own staff can cost more, take longer to start, and depend on the skills, capacity and availability of staff, who may leave.
6External development advantages — Hiring an outside developer gives specialist skills and extra capacity, often with faster delivery and a fixed contract cost, without hiring permanent staff.
7External development risks — Using an outside developer gives the organisation less control over security, means sharing data with a third party, and can raise IP ownership and vendor dependency risks.
8sourcing decision — Choosing in-house or external developers by weighing cost, skills, control, security and time against the organisation's objectives, sometimes using a hybrid of both.
9cyber security incident — An event that actually or potentially compromises the confidentiality, integrity or availability of an organisation's systems or data, such as a breach or malware infection.
10development, testing and production — The three environments software moves through: development is where code is written, testing is where it is checked with test data, and production is where real users use live data.