VCE Software Development U4O2 Definitions Worksheet: Vulnerabilities and risks in insecure development environments and Third-party software, code review and combined environments (Modules 23–47)
Name:
Date:
Class:
✎
Key terms
Write what each term means, in your own words.
1
insecure development environment
2
API
3
API security risk
4
hard-coded secret
5
Unpatched software
6
Poor identity and access management
7
man-in-the-middle attack
8
third-party software risk
9
ineffective code review
10
combined environment
Answer Key
VCE Software Development U4O2 · Modules 23–47 · Student wording will vary for definitions
1insecure development environment — A workspace where weak controls over people, tools, code and data let vulnerabilities enter the software or let attackers reach it.
2API — Application programming interface: a set of defined requests that lets one piece of software use the data or functions of another, such as sending a request and getting a response back.
3API security risk — An API is risky when it lacks authentication, input validation or rate limits, so attackers can send requests straight to it and steal data or misuse it.
4hard-coded secret — A key, password or token written directly into source code. Anyone who can read the code or its repository can steal it, and deleting the file later does not remove it from the history.
5Unpatched software — Software missing security updates, so known flaws stay open. In a dev environment, attackers can use them on developer machines or build servers to reach code and data.
6Poor identity and access management — Weak control of accounts, permissions and logins, such as shared accounts or no MFA, so the wrong people or systems can reach code and data.
7man-in-the-middle attack — An attack where someone secretly sits between two parties and can read or change the data passing between them, such as logins, session tokens or code sent over an unsecured network.
8third-party software risk — Risk from software bought, outsourced or downloaded, as you cannot fully see or control how it was built and maintained (poor code, backdoors, no support, licence issues).
9ineffective code review — Code review that is skipped, rushed, done only by the author or lacks a security checklist, so flaws get merged and reach production.
10combined environment — One shared environment used for development, testing and production, so untested code and live data mix and mistakes or attacks can reach real users and data.