VCE Software Development U4O2 Definitions Worksheet: Threat modelling and evaluating security practices and Copyright, Essential Eight and the ISM (Modules 81–95)
Name:
Date:
Class:
✎
Key terms
Write what each term means, in your own words.
1
Risk treatment
2
Verification testing
3
evaluation criteria
4
rate and justify
5
Analysing a case study
6
gap analysis
7
patch applications and operating systems
8
restrict administrative privileges
9
Application control and MFA
10
regular backups
Answer Key
VCE Software Development U4O2 · Modules 81–95 · Student wording will vary for definitions
1Risk treatment — Matching each threat to a response chosen by its risk rating: eliminate it, reduce it, transfer it (e.g. insure) or accept it. High risks are treated first.
2Verification testing — Retesting a control after it is applied, using code review and security tests, to prove the threat is reduced, check no new weakness exists, note residual risk and record the evidence.
3evaluation criteria — Measurable standards, such as access control, code review, patching and training, used to judge how effective and compliant an organisation's development practices are.
4rate and justify — Judge a practice as met, partly met or not met against one criterion, then justify the rating by quoting evidence from the case study and explaining the consequence.
5Analysing a case study — Describe how the organisation builds software: who is involved, which environments and tools it uses, and which security controls it has, then spot gaps.
6gap analysis — Comparing a case study's current practices with secure practice to find vulnerabilities, then rating the risk each gap creates by its likelihood and impact.
7patch applications and operating systems — Two Essential Eight strategies: apply security updates to apps and operating systems promptly, with critical patches done fast, so known vulnerabilities are closed before attackers exploit them.
8restrict administrative privileges — An Essential Eight strategy: give admin accounts only to people who need them, only for tasks that need them, using separate admin accounts and limited production access.
9Application control and MFA — Essential Eight controls: application control lets only approved software run, and MFA needs extra proof of identity, so both block unauthorised access and malware.
10regular backups — An Essential Eight strategy: keep tested, protected copies of data and code, made often, so work can be restored after loss, tampering or ransomware.