VCE Software Development U4O2 Definitions Worksheet: Security controls for development practices and stored data and Threat modelling and evaluating security practices (Modules 49–72)
Name:
Date:
Class:
✎
Key terms
Write what each term means, in your own words.
1
code repository
2
repository security
3
Encryption at rest and in transit
4
peer code review
5
automated code analysis
6
patch management
7
Environment separation
8
secrets management
9
threat modelling
10
security requirement
Answer Key
VCE Software Development U4O2 · Modules 49–72 · Student wording will vary for definitions
1code repository — A central store for a project's source code and its version history, shared by a team through commits, branches, pull requests and access settings (private or public).
2repository security — Controlling who can read and change a code repository and protecting what is stored in it, e.g. private repos, roles, a protected main branch, no secrets in commits, audit logs.
3Encryption at rest and in transit — Encrypting data both while stored (databases, backups) and while moving over a network (TLS), so intercepted or stolen data stays unreadable without the key.
4peer code review — Another developer checks a change before it is merged, using a checklist that includes security checks, and approves it. The decision is recorded on the pull request.
5automated code analysis — Tools that scan source code or dependencies for known insecure patterns and vulnerable components. They support, but do not replace, human code review.
6patch management — The regular, planned process of finding, testing and installing updates that fix known vulnerabilities in software, including libraries and frameworks.
7Environment separation — Keeping development, testing and production apart so untested code and live data never mix, and access to each is controlled separately. It also helps contain a breach.
8secrets management — Keeping passwords, API keys and tokens in a protected vault or environment variable, not in source code, and rotating keys and scanning commits for leaks.
9threat modelling — A structured way to work out what could go wrong with a system, before and during development, so risks are found, fixed and confirmed early and then reviewed again.
10security requirement — A statement of the protection a system must provide for its data and functions, based on its assets, users and laws, written so it can be tested.