← VCE Software Development U4O2

Identifying and mitigating threats

Matching each threat to a response chosen by its risk rating: eliminate it, reduce it, transfer it (e.g. insure) or accept it. High risks are treated first.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 81, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 53

Understanding Identifying and mitigating threats in VCE Software Development U4O2

What it does: A parameterised query is a control that reduces the likelihood of SQL injection. The threat still exists but is much less likely to succeed. Transferring shifts some of the impact to a third party such as an insurer. The threat can still happen but the organisation does not carry all the cost. Risk ratings set the order of treatment. High risks are dealt with first because they combine high likelihood with serious impact. Eliminating a threat removes its cause entirely. If the feature is deleted, the vulnerability no longer exists. Risk treatment chooses a response for each threat based on its rating. Not every threat can or should be eliminated.

Common mistakes: High risks must be treated first. The flag should be treat_first = True so the SQL injection threat is dealt with before lower risks. Only low-rated risks should be accepted. The test should be <= 2 (a low score), not >= 2, which would let higher risks be accepted.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Identifying and mitigating threats to a class →

This module's key terms are also in a printable crossword (Modules 81–95) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A threat has a HIGH risk rating and a MEDIUM threat sits beside it on the risk register. Which should the team treat first?
The MEDIUM risk threatThe HIGH risk threat
Matches
Risk register: Low risks fixed first, High risks accepted
↓
The priority is backwards. High risks must be treated first, while low risks are the ones most likely to be accepted.
Applying
Meanings
Term
Risk treatment
Meaning
Matching each threat to a response chosen by its risk rating: eliminate it, reduce it, transfer it (e.g. insure) or accept it. High risks are treated first.
Practice
FOR EACH threat IN threatList
Testing
Gaps
treatment ← ""
Check Answer
Spots
3if rating == "High":
4 treat_first = False

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Viperfish' badge — Deep Debugger, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A threat has a HIGH risk rating and a MEDIUM threat sits beside it on the risk register. Which should the team treat first?
A. The MEDIUM risk threat
B. The HIGH risk threat ✓
Risk ratings set the order of treatment. High risks are dealt with first because they combine high likelihood with serious impact.
2. A login page has an old admin feature nobody uses, and it has a serious flaw. Removing the feature completely is which type of response?
A. Eliminate ✓
B. Accept
Eliminating a threat removes its cause entirely. If the feature is deleted, the vulnerability no longer exists.
3. Adding input validation to a form so SQL injection is much harder is which type of response?
A. Transfer
B. Reduce ✓
A control such as input validation lowers the likelihood or impact of a threat but does not remove it entirely. That is reducing the risk.
4. A company buys cyber insurance to cover the cost of a data breach. Which response is this?
A. Transfer ✓
B. Eliminate
Insurance moves the financial impact to another party. The threat still exists, so it is transferred rather than eliminated.
5. A threat is rated LOW and fixing it would cost far more than the harm it could cause. What is a sensible response?
A. Accept the risk and monitor it ✓
B. Spend the whole budget eliminating it
Accepting is valid for low risks when the cost of treatment outweighs the possible harm. The decision should be documented and the risk monitored.

Match the Pairs

Eliminate: remove the vulnerable feature → Removes the threat completely, for example deleting an unused upload page that attackers could exploit
Accept: log the risk and monitor it → Keeps the threat as it is because its risk rating is low and the cost of treating it is higher than the harm it could cause
Reduce a high-rated SQL injection threat by lowering its likelihood → cursor.execute("SELECT * FROM users WHERE id = ?", (uid,))
Transfer the financial impact of a data breach to another party → Buy cyber insurance cover for breach costs
Risk register: Low risks fixed first, High risks accepted → The priority is backwards. High risks must be treated first, while low risks are the ones most likely to be accepted.
Threat: stolen password. Response: Accept (no control) → A stolen password is a likely, high-impact threat, so accepting it is the wrong choice. It needs a control such as MFA to reduce it.

Key Term

Risk treatment
Matching each threat to a response chosen by its risk rating: eliminate it, reduce it, transfer it (e.g. insure) or accept it. High risks are treated first.

Fill in the Blanks

1. threat ← "Unused debug page can be exploited" treatment ← "Eliminate"
Hint: Type the treatment that removes the threat completely, such as deleting the unused feature.
2. threat ← "Costly data breach" buyCyberInsurance() treatment ← "Transfer"
Hint: Type the treatment that shifts the financial impact of the risk to another party, such as an insurer.
3. IF rating = "Low" THEN treatment ← "Accept" END IF
Hint: Type the treatment used when a risk is low and a control would cost more than the harm. The risk is just monitored.
4. SORT threats BY riskScore DESCENDING FOR EACH t IN threats applyControl(t)
Hint: Type the sort-order keyword that puts the highest risks first so they are treated first.
5. riskScore ← likelihood * impact IF riskScore >= 15 THEN reduce(threat)
Hint: Type the arithmetic operator that combines likelihood and impact into a risk score.

Spot the Error

Question 1
A threat = "SQL injection"
B rating = "High"
C if rating == "High":
D treat_first = False
Line D — High risks must be treated first. The flag should be treat_first = True so the SQL injection threat is dealt with before lower risks.
Question 2
A likelihood = 1
B impact = 1
C if likelihood * impact >= 2:
D response = "Accept"
Line C — Only low-rated risks should be accepted. The test should be <= 2 (a low score), not >= 2, which would let higher risks be accepted.
Question 3
A threat = "Server outage costs"
B action = "buy insurance"
C response = "Accept"
D print(threat, response)
Line C — Buying insurance shifts the financial loss to another party. That is the Transfer response, not Accept.
Question 4
A threat = "Old admin account"
B action = "delete the account"
C removes_threat = True
D response = "Reduce"
Line D — Deleting the account removes the threat completely, so the response is Eliminate. Reduce only lowers the likelihood or impact.
Question 5
A threat = "Weak passwords"
B action = "enforce MFA"
C response = "Eliminate"
D print(response)
Line C — MFA makes a stolen password much less useful, but the threat still exists. It lowers the risk, so the response is Reduce, not Eliminate.

Student with a class code? Join your class →