External development: disadvantages

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. An organisation hires an external developer. Which statement about security practices is correct?

A The organisation has less control over how the developer secures code and systems

B The organisation has the same control as in-house, because it is paying for the work

2. A company gives an external developer a copy of its customer database to test the app. What is the main risk?

A The data automatically becomes encrypted and no longer needs protection

B Sharing data with a third party increases the chance of a data breach or misuse

3. Which statement about intellectual property (IP) is correct when using an external developer?

A Ownership of the code may be unclear unless the contract states it

B The paying organisation always owns the code, whatever the contract says

4. A small vendor builds a company's software, then closes down. Which risk does this show?

A Insider threat: the vendor deliberately leaked the source code

B Vendor dependency: no one is left to support or update the software

5. Which is a disadvantage of external development?

A Security patches depend on the vendor's schedule and willingness to support the product

B The organisation must train its own staff to write every line of code

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Less control over security practices		AThis ignores the loss of control. The organisation still needs to check the developer's security practices, because it remains responsible for its data and software.
2Vendor dependency and support		BThe organisation relies on the external developer to maintain, fix and update the software, so it is at risk if the vendor raises prices, stops support or goes out of business.
3Sharing data with a third party increases the chance of a data breach, because customer records leave the organisation's own systems.		CGive external developer a copy of customer database for testing
4Intellectual property ownership can be unclear if the contract does not state who owns the code the developer writes.		DContract does not say who owns the source code
5External developers are always more secure, so the organisation does not need to check their practices.		EOwnership of IP is not automatic. Unless the contract assigns it, the developer may keep ownership or licence rights, so IP terms must be agreed in writing.
6The organisation owns all code an external developer writes, even with no written agreement.		FThe organisation cannot directly decide or check how the external developer secures code, devices, and staff access, so it relies on the developer's own standards.

Definitions

External development risks

Fill in the Blanks

Complete each line of code by filling in the missing parts.

vendorHasAccess ← TRUE IF _______________ = TRUE THEN DISPLAY "Data shared with third party"

contract.ipOwner ← "vendor" IF contract.ipOwner _ "organisation" THEN DISPLAY "IP ownership risk"

vendorSupport ← FALSE IF ___ vendorSupport THEN DISPLAY "Dependency risk: no updates"

securityChecks ← ["review", "testing"] FOR EACH check IN ______________ DO DISPLAY "Ask vendor about " + check

external ← TRUE IF external ___ sharesData THEN DISPLAY "Third party holds our data"

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A IF developer = external THEN

B control_over_security ← HIGH

C ELSE

D control_over_security ← HIGH

E END IF

Question 2

A developer ← external

B IF developer = external THEN

C share_data ← TRUE

D data_risk ← LOWER

E END IF

Question 3

A developer ← external

B IF has_ip_clause THEN

C owner ← DEVELOPER

D ip_risk ← TRUE

E END IF

Question 4

A vendor ← external_company

B IF vendor.stops_support THEN

C patches ← GUARANTEED

D dependency_risk ← HIGH

E END IF

Question 5

A data ← customer_records

B test_data ← data

C SEND test_data TO developer

D LOG data_shared

Answer Key

External development: disadvantages

Section A: Quick Questions

A — The organisation has less control over how the developer secures code and systems

B — Sharing data with a third party increases the chance of a data breach or misuse

A — Ownership of the code may be unclear unless the contract states it

B — Vendor dependency: no one is left to support or update the software

A — Security patches depend on the vendor's schedule and willingness to support the product

Section B: Match the Pairs

Less control over security practices → The organisation cannot directly decide or check how the external developer secures code, devices, and staff access, so it relies on the developer's own standards.

Vendor dependency and support → The organisation relies on the external developer to maintain, fix and update the software, so it is at risk if the vendor raises prices, stops support or goes out of business.

Sharing data with a third party increases the chance of a data breach, because customer records leave the organisation's own systems. → Give external developer a copy of customer database for testing

Intellectual property ownership can be unclear if the contract does not state who owns the code the developer writes. → Contract does not say who owns the source code

External developers are always more secure, so the organisation does not need to check their practices. → This ignores the loss of control. The organisation still needs to check the developer's security practices, because it remains responsible for its data and software.

The organisation owns all code an external developer writes, even with no written agreement. → Ownership of IP is not automatic. Unless the contract assigns it, the developer may keep ownership or licence rights, so IP terms must be agreed in writing.

Section C: Definitions

External development risks — Using an outside developer gives the organisation less control over security, means sharing data with a third party, and can raise IP ownership and vendor dependency risks.

Section D: Fill in the Blanks

vendorHasAccess ← TRUE
IF vendorHasAccess = TRUE THEN
    DISPLAY "Data shared with third party"

contract.ipOwner ← "vendor"
IF contract.ipOwner ≠ "organisation" THEN
    DISPLAY "IP ownership risk"

vendorSupport ← FALSE
IF NOT vendorSupport THEN
    DISPLAY "Dependency risk: no updates"

securityChecks ← ["review", "testing"]
FOR EACH check IN securityChecks DO
    DISPLAY "Ask vendor about " + check

external ← TRUE
IF external AND sharesData THEN
    DISPLAY "Third party holds our data"

Section E: Spot the Error

B — With an external developer the organisation has LESS control over security practices, so control should be set to LOW, not HIGH.

D — Sharing data with a third party increases the chance of a leak or misuse, so data_risk should be HIGHER, not LOWER.

B — The IP risk applies when the contract has NO clause giving the organisation ownership. The condition should be no_ip_clause, otherwise the developer ownership result makes no sense.

C — If the vendor stops providing support, security patches and fixes are no longer provided. It should be NONE, not GUARANTEED. This is the vendor dependency risk.

B — Sending real customer records to a third party exposes personal data. The data should be masked (MASK(data)) so only the minimum necessary is shared.