VCE Software Development U4O2 Definitions Worksheet: Copyright, Essential Eight and the ISM to Mitigation and improving secure development practices (Modules 97–130)
Name:
Date:
Class:
✎
Key terms
Write what each term means, in your own words.
1
ISM Guidelines for Software Development
2
Apply a privacy principle
3
Ineffective security practices
4
copyright
5
software licence
6
copyright infringement
7
legal and ethical consequences
8
mitigation measure
9
incident response plan
10
Onboarding and induction
11
Developer training
12
risk management plan
13
risk register
14
recommendation
Answer Key
VCE Software Development U4O2 · Modules 97–130 · Student wording will vary for definitions
1ISM Guidelines for Software Development — ISM guidelines that set security expectations for how software is designed, coded, tested and released, such as secure coding, separate environments, code review and testing.
2Apply a privacy principle — Identify the personal information involved, state what the principle requires, then judge whether the organisation's development practice meets it.
3Ineffective security practices — An ethical issue: people whose data is held can be harmed by a breach the organisation could have prevented, so it has a duty of care to protect them and be open if it fails.
4copyright — The legal right of the person who writes original code to control who can copy, share or sell it. Others need the owner's permission, even for a classmate's code.
5software licence — A legal agreement stating how you may use, change and share code. Open-source licences allow reuse if you follow their terms, such as giving credit to the author.
6copyright infringement — Using someone else's code, including AI output that copies licensed work, without checking its source or licence. It can breach copyright and is an ethical issue for developers.
7legal and ethical consequences — Penalties, lost customer trust and harm caused by weak security in development, such as privacy breaches or copyright infringement, resolved through compliance, openness and better practices.
8mitigation measure — An action that reduces or eliminates a specific threat, vulnerability or risk, such as a technical, process or people control matched to the risk it addresses.
9incident response plan — A plan written in advance that sets out who does what to detect, contain, recover from and learn from a cyber security incident, including roles, contacts, reporting and review.
10Onboarding and induction — Introducing new developers to an organisation's security policies, tools and expected practices from their first day, so they work securely from the start.
11Developer training — Ongoing training that gives developers the skills and awareness to write secure code and spot threats such as phishing, which reduces human error.
12risk management plan — A document that identifies risks to software development, rates them, assigns responses and owners, and sets a schedule for regular review. It links to the threat model.
13risk register — A table listing each project risk with its likelihood, impact and planned response (like backups), so the team can tackle the biggest risks first and review them often.
14recommendation — A specific improvement linked to an identified weakness and justified by its benefits, its costs and the criteria it improves, such as laws, frameworks or measurable security.