← VCE Software Development U4O2

External development: disadvantages

Using an outside developer gives the organisation less control over security, means sharing data with a third party, and can raise IP ownership and vendor dependency risks.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 7

Understanding External development: disadvantages in VCE Software Development U4O2

What it does: Handing real customer data to an outside developer is an example of sharing data with a third party, which widens exposure. Without a clear contract clause, the developer may keep ownership or reuse the code, which is the IP risk of external development. Outside developers follow their own security practices, so the organisation has less direct control. Contracts and audits can reduce the gap but not remove it. Under the Copyright Act 1968 (Cwlth), the developer can be the default owner of what they create. A written agreement is needed to assign IP to the client. Relying on one vendor for updates and fixes is vendor dependency. If the vendor stops operating, the software may go unpatched and become vulnerable.

Common mistakes: With an external developer the organisation has LESS control over security practices, so control should be set to LOW, not HIGH. Sharing data with a third party increases the chance of a leak or misuse, so data_risk should be HIGHER, not LOWER.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add External development: disadvantages to a class →

This module's key terms are also in a printable crossword (Modules 1–22) and word search (Modules 1–47).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
An organisation hires an external developer. Which statement about security practices is correct?
The organisation has less control over how the developer secures code and systemsThe organisation has the same control as in-house, because it is paying for the work
Matches
External developers are always more secure, so the organisation does not need to check their practices.
↓
This ignores the loss of control. The organisation still needs to check the developer's security practices, because it remains responsible for its data and software.
Applying
Meanings
Term
External development risks
Meaning
Using an outside developer gives the organisation less control over security, means sharing data with a third party, and can raise IP ownership and vendor dependency risks.
Practice
IF securityControl = "vendor" THEN
Testing
Gaps
IF = TRUE THEN
Check Answer
Spots
1IF developer = external THEN
2 control_over_security ← HIGH

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Coelacanth' badge — Living Fossil, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. An organisation hires an external developer. Which statement about security practices is correct?
A. The organisation has less control over how the developer secures code and systems ✓
B. The organisation has the same control as in-house, because it is paying for the work
Outside developers follow their own security practices, so the organisation has less direct control. Contracts and audits can reduce the gap but not remove it.
2. A company gives an external developer a copy of its customer database to test the app. What is the main risk?
A. The data automatically becomes encrypted and no longer needs protection
B. Sharing data with a third party increases the chance of a data breach or misuse ✓
Once data leaves the organisation, it relies on the third party's security. The organisation is still responsible for protecting it.
3. Which statement about intellectual property (IP) is correct when using an external developer?
A. Ownership of the code may be unclear unless the contract states it ✓
B. The paying organisation always owns the code, whatever the contract says
Under the Copyright Act 1968 (Cwlth), the developer can be the default owner of what they create. A written agreement is needed to assign IP to the client.
4. A small vendor builds a company's software, then closes down. Which risk does this show?
A. Insider threat: the vendor deliberately leaked the source code
B. Vendor dependency: no one is left to support or update the software ✓
Relying on one vendor for updates and fixes is vendor dependency. If the vendor stops operating, the software may go unpatched and become vulnerable.
5. Which is a disadvantage of external development?
A. Security patches depend on the vendor's schedule and willingness to support the product ✓
B. The organisation must train its own staff to write every line of code
Needing to wait for the vendor to fix flaws is a disadvantage. Having to write all the code is an in-house trait, not an external one.

Match the Pairs

Less control over security practices → The organisation cannot directly decide or check how the external developer secures code, devices, and staff access, so it relies on the developer's own standards.
Vendor dependency and support → The organisation relies on the external developer to maintain, fix and update the software, so it is at risk if the vendor raises prices, stops support or goes out of business.
Sharing data with a third party increases the chance of a data breach, because customer records leave the organisation's own systems. → Give external developer a copy of customer database for testing
Intellectual property ownership can be unclear if the contract does not state who owns the code the developer writes. → Contract does not say who owns the source code
External developers are always more secure, so the organisation does not need to check their practices. → This ignores the loss of control. The organisation still needs to check the developer's security practices, because it remains responsible for its data and software.
The organisation owns all code an external developer writes, even with no written agreement. → Ownership of IP is not automatic. Unless the contract assigns it, the developer may keep ownership or licence rights, so IP terms must be agreed in writing.

Key Term

External development risks
Using an outside developer gives the organisation less control over security, means sharing data with a third party, and can raise IP ownership and vendor dependency risks.

Fill in the Blanks

1. vendorHasAccess ← TRUE IF vendorHasAccess = TRUE THEN DISPLAY "Data shared with third party"
Hint: Type the variable name set on the first line that records whether the vendor can reach the organisation's data.
2. contract.ipOwner ← "vendor" IF contract.ipOwner ≠ "organisation" THEN DISPLAY "IP ownership risk"
Hint: Type the comparison operator that is true when the IP owner is not the organisation.
3. vendorSupport ← FALSE IF NOT vendorSupport THEN DISPLAY "Dependency risk: no updates"
Hint: Type the logical keyword that flips a value, so the warning shows when the vendor no longer provides support.
4. securityChecks ← ["review", "testing"] FOR EACH check IN securityChecks DO DISPLAY "Ask vendor about " + check
Hint: Type the name of the list the loop goes through, so the organisation can ask the vendor about each of its security practices.
5. external ← TRUE IF external AND sharesData THEN DISPLAY "Third party holds our data"
Hint: Type the logical operator that needs both conditions to be true before the data-sharing risk is flagged.

Spot the Error

Question 1
A IF developer = external THEN
B control_over_security ← HIGH
C ELSE
D control_over_security ← HIGH
E END IF
Line B — With an external developer the organisation has LESS control over security practices, so control should be set to LOW, not HIGH.
Question 2
A developer ← external
B IF developer = external THEN
C share_data ← TRUE
D data_risk ← LOWER
E END IF
Line D — Sharing data with a third party increases the chance of a leak or misuse, so data_risk should be HIGHER, not LOWER.
Question 3
A developer ← external
B IF has_ip_clause THEN
C owner ← DEVELOPER
D ip_risk ← TRUE
E END IF
Line B — The IP risk applies when the contract has NO clause giving the organisation ownership. The condition should be no_ip_clause, otherwise the developer ownership result makes no sense.
Question 4
A vendor ← external_company
B IF vendor.stops_support THEN
C patches ← GUARANTEED
D dependency_risk ← HIGH
E END IF
Line C — If the vendor stops providing support, security patches and fixes are no longer provided. It should be NONE, not GUARANTEED. This is the vendor dependency risk.
Question 5
A data ← customer_records
B test_data ← data
C SEND test_data TO developer
D LOG data_shared
Line B — Sending real customer records to a third party exposes personal data. The data should be masked (MASK(data)) so only the minimum necessary is shared.

Student with a class code? Join your class →