← VCE Software Development U4O2

Ethical issue: ineffective security practices

An ethical issue: people whose data is held can be harmed by a breach the organisation could have prevented, so it has a duty of care to protect them and be open if it fails.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 112, WA Computer Science ATAR Year 11 — Cyber Security — Module 169

Understanding Ethical issue: ineffective security practices in VCE Software Development U4O2

What it does: The code shows security being dropped to save money, which puts the cost of a breach on users who had no say in the decision. The list shows that many stakeholders suffer when a breach occurs, such as identity theft for customers and lost trust for the organisation. Ethics goes beyond the law. People trusted the organisation with their data, so it has a duty of care to protect them. Knowingly leaving a vulnerability unfixed is a failure of duty of care, even if no attack has happened yet. Security failures lead to stolen identities, financial loss and distress, so they affect people and not just systems.

Common mistakes: This only notifies users when there is no breach. Users whose data was exposed must be told, so the condition should be 'if breach_found:'. An organisation holding people's data has a duty of care to protect it. The call should be protect(data_held), not ignore(data_held).

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Ethical issue: ineffective security practices to a class →

This module's key terms are also in a printable crossword (Modules 97–130) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
An organisation stores customers' personal data. Which statement best describes its ethical duty?
It only needs to protect the data if a law forces it toIt has a duty of care to protect that data from preventable harm
Matches
if breach: hide_incident()
↓
Hiding a breach is unethical because affected users cannot protect themselves. The organisation should be open and notify them.
Applying
Meanings
Term
Ineffective security practices
Meaning
An ethical issue: people whose data is held can be harmed by a breach the organisation could have prevented, so it has a duty of care to protect them and be open if it fails.
Practice
IF data_is_personal = TRUE THEN
Testing
Gaps
if breach: (affectedusers)
Check Answer
Spots
1breach_found = True
2if not breach_found:

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Space Turtle' badge — Speed in Zero-G, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. An organisation stores customers' personal data. Which statement best describes its ethical duty?
A. It only needs to protect the data if a law forces it to
B. It has a duty of care to protect that data from preventable harm ✓
Ethics goes beyond the law. People trusted the organisation with their data, so it has a duty of care to protect them.
2. A company skips security testing to save money and launch sooner. Is this an ethical issue?
A. Yes, cutting security to save money puts users at risk of preventable harm ✓
B. No, saving money is always a good business decision
Putting cost-cutting ahead of security shifts the risk onto the users whose data is held, which is an ethical problem.
3. Who can be harmed when a poorly secured system suffers a data breach?
A. Only the developers who wrote the code
B. Users, employees, the organisation and its partners ✓
Many stakeholders are affected: users may face identity theft, staff lose trust, and the organisation suffers reputational and financial damage.
4. A breach happens because a known patch was never applied. Why is this an ethical failure?
A. The harm could have been prevented with an effective practice ✓
B. The harm was unavoidable, so nobody is responsible
Ethical responsibility is stronger when a breach was preventable. Applying the patch was a practice that would have stopped it.
5. After a breach, which action is the more ethical response?
A. Promptly tell affected users so they can protect themselves ✓
B. Stay quiet to protect the company's reputation
Being open after an incident lets users change passwords or watch their accounts. Hiding a breach adds to the harm.

Match the Pairs

duty_of_care = protect_user_data() → The organisation has an ethical duty to protect the people whose data it holds from preventable harm
notify_users(breach_details) → Being open after an incident by promptly telling affected people what happened so they can protect themselves
Cost-cutting vs security: skipping security work to save money is unethical when users bear the harm of a preventable breach → if budget_low: skip_security_testing()
Stakeholders harmed by a breach include customers, employees and the organisation itself, so all of them must be considered → harmed = [customers, staff, company]
if breach: hide_incident() → Hiding a breach is unethical because affected users cannot protect themselves. The organisation should be open and notify them.
security_budget = 0 # saves money → Cutting security spending to save money ignores the duty of care. Users could be harmed by a breach that proper practices would have prevented.

Key Term

Ineffective security practices
An ethical issue: people whose data is held can be harmed by a breach the organisation could have prevented, so it has a duty of care to protect them and be open if it fails.

Fill in the Blanks

1. if breach: notify(affected_users)
Hint: Type the function name that tells the people whose data was exposed, which is being open after an incident.
2. if budget < needed: risk = "high"
Hint: Type the comparison operator that checks whether cost-cutting leaves the budget short of what is needed.
3. for person in affected_users: send(person)
Hint: Type the loop keyword that repeats an action for every stakeholder harmed by the breach.
4. if not data_encrypted: log_risk(user_data)
Hint: Type the logical operator that reverses the condition, so the check runs when user data is left unprotected.
5. def report_breach(users): notify(users)
Hint: Type the keyword that defines a new function in Python, here one that openly reports a breach to users.

Spot the Error

Question 1
A breach_found = True
B if not breach_found:
C notify_users()
Line B — This only notifies users when there is no breach. Users whose data was exposed must be told, so the condition should be 'if breach_found:'.
Question 2
A data_held = "customer records"
B duty_of_care = True
C if duty_of_care:
D ignore(data_held)
Line D — An organisation holding people's data has a duty of care to protect it. The call should be protect(data_held), not ignore(data_held).
Question 3
A security_budget = 20000
B needed = 50000
C if security_budget > needed:
D warn_board()
Line C — The board should be warned when the security budget is LESS than what is needed (cost-cutting). The operator should be <, not >.
Question 4
A harmed = ["users", "staff"
B for person in harmed:
C support(person)
Line A — The list is missing its closing square bracket. It should end with ] so the stakeholders harmed by a breach are stored correctly.
Question 5
A saved = 10000
B breach_cost = 500000
C if breach_cost < saved:
D print("Not worth it")
Line C — Cutting security is not worth it when a breach costs MORE than the money saved. The test should be breach_cost > saved.

Student with a class code? Join your class →