← VCE Software Development U4O2

Identifying vulnerabilities and risks from a case study

Comparing a case study's current practices with secure practice to find vulnerabilities, then rating the risk each gap creates by its likelihood and impact.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 88, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 52

Understanding Identifying vulnerabilities and risks from a case study in VCE Software Development U4O2

What it does: The practice is compared with secure practice (hashing and encryption). The gap becomes the vulnerability, which shows the link from practice to vulnerability. The vulnerability is the weakness. The risk states what could go wrong if a threat actor exploits it, naming the harm to the organisation. Risk is rated by how likely the harm is to happen and how severe the impact would be if it did. Rating needs evidence from the case study. Sensitive data plus an insecure network means high likelihood and high impact. Occasional use does not make the risk low. Vulnerabilities exist even before an attack happens. Each gap is linked to a risk and then rated, so it can be prioritised.

Common mistakes: The risk must follow from the gap. Having no unique accounts creates a risk of unauthorised access, not lost backup tapes. The case study says bugs are found weekly, so the risk happens often. The likelihood should be high (almost certain), not rare.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Identifying vulnerabilities and risks from a case study to a class →

This module's key terms are also in a printable crossword (Modules 81–95) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A case study says developers share one admin password written on a whiteboard. What is the best way to identify the vulnerability?
Compare the practice with secure practice: shared, visible credentials weaken identity and access managementIgnore it, because a whiteboard is not part of the software being built
Matches
Vulnerability: "The company has a firewall"
↓
This describes a secure practice, not a gap. A vulnerability must come from a current practice that falls short of secure practice.
Applying
Meanings
Term
gap analysis
Meaning
Comparing a case study's current practices with secure practice to find vulnerabilities, then rating the risk each gap creates by its likelihood and impact.
Practice
Current practice: Shared admin password
Testing
Gaps
practice ≠ securePractice THEN
Check Answer
Spots
2gap = "No unique accounts"
3risk = "Lost backup tapes"

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Silverback Gorilla' badge — Savannah Master, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A case study says developers share one admin password written on a whiteboard. What is the best way to identify the vulnerability?
A. Ignore it, because a whiteboard is not part of the software being built
B. Compare the practice with secure practice: shared, visible credentials weaken identity and access management ✓
Gap analysis starts by linking a current practice to a vulnerability. Shared, visible passwords are a gap against secure credential management.
2. Which statement correctly links a vulnerability to a risk?
A. Vulnerability: a data breach. Risk: no code review is carried out
B. Vulnerability: no code review. Risk: insecure code is released and exploited, causing a data breach ✓
The vulnerability is the weakness (the gap). The risk is the possible harm if it is exploited. The second option reverses them.
3. A case study says the company never installs OS updates on developer laptops. This is a:
A. Practice that creates a vulnerability (unpatched software) ✓
B. Risk rating of high
A practice is what the organisation does. Not patching is the practice, and unpatched software is the vulnerability it creates. A rating comes later.
4. To rate a risk, which two factors do you consider?
A. Likelihood and impact ✓
B. Cost and speed of the development team
Risk is rated by how likely the harm is to happen and how severe the impact would be if it did.
5. A public Wi-Fi network is used to access the production database, and customer records are stored there. Which rating is the most reasonable?
A. High: an attack is likely and the impact on confidential data would be severe ✓
B. Low: because the Wi-Fi network is only used some of the time
Rating needs evidence from the case study. Sensitive data plus an insecure network means high likelihood and high impact. Occasional use does not make the risk low.

Match the Pairs

Practice: "All developers share one admin login" → A current practice that departs from secure practice (least privilege and individual accounts), so it is a gap to flag as a vulnerability
Risk: Likelihood = High, Impact = Severe → A rating of a risk that is both likely to happen and very damaging, so it should be treated as a top priority
Link a practice to a vulnerability: the case study says passwords are stored as plain text, which departs from secure practice → Practice: plain text passwords -> Vulnerability: stolen database exposes every password
Link a vulnerability to a risk: a weakness only becomes a risk when a threat could exploit it and cause harm → Vulnerability: no input validation -> Risk: SQL injection leads to a data breach
Vulnerability: "The company has a firewall" → This describes a secure practice, not a gap. A vulnerability must come from a current practice that falls short of secure practice.
Risk rating: Likelihood = Low, Impact = Low, so fix this first → The rating and the priority do not match. A low likelihood and low impact risk is a low priority and should be treated after higher rated risks.

Key Term

gap analysis
Comparing a case study's current practices with secure practice to find vulnerabilities, then rating the risk each gap creates by its likelihood and impact.

Fill in the Blanks

1. IF practice ≠ securePractice THEN vulnerability ← true END IF
Hint: Type the keyword that starts a decision, testing whether a case study practice falls short of secure practice.
2. riskScore ← likelihood * impact
Hint: Type the variable that shows how probable it is that the vulnerability will be exploited.
3. riskScore ← likelihood * impact
Hint: Type the arithmetic operator that combines likelihood and impact into one risk score.
4. IF riskScore > 12 THEN treatFirst ← true END IF
Hint: Type the comparison operator meaning the score is greater than the threshold for a high risk.
5. FOR EACH practice IN caseStudyPractices COMPARE practice WITH securePractice END FOR
Hint: Type the keyword that loops through every practice in the case study collection.

Spot the Error

Question 1
A practice = "Shared login"
B gap = "No unique accounts"
C risk = "Lost backup tapes"
Line C — The risk must follow from the gap. Having no unique accounts creates a risk of unauthorised access, not lost backup tapes.
Question 2
A evidence = "Bugs found weekly"
B risk = "Buggy code goes live"
C likelihood = "Rare"
Line C — The case study says bugs are found weekly, so the risk happens often. The likelihood should be high (almost certain), not rare.
Question 3
A practice = "Unpatched server"
B gap = "Software is up to date"
C risk = "Exploit by attackers"
D impact = "High"
Line B — An unpatched server is a gap because known flaws are left open. Saying the software is up to date contradicts the practice.
Question 4
A practice = "MFA enforced"
B gap = "Poor credential care"
C risk = "Account takeover"
Line A — The current practice must be the weak one that creates the gap. Enforcing MFA is secure practice, so it would not lead to poor credential care.
Question 5
A risk = "Customer data leaked"
B impact = "Minor"
C likelihood = "Possible"
D rating = "High"
Line B — Leaked customer data causes serious harm, such as privacy breaches, fines and lost trust. The impact should be severe, not minor.

Student with a class code? Join your class →