Identifying vulnerabilities and risks from a case study

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A case study says developers share one admin password written on a whiteboard. What is the best way to identify the vulnerability?

A Ignore it, because a whiteboard is not part of the software being built

B Compare the practice with secure practice: shared, visible credentials weaken identity and access management

2. Which statement correctly links a vulnerability to a risk?

A Vulnerability: a data breach. Risk: no code review is carried out

B Vulnerability: no code review. Risk: insecure code is released and exploited, causing a data breach

3. A case study says the company never installs OS updates on developer laptops. This is a:

A Practice that creates a vulnerability (unpatched software)

B Risk rating of high

4. To rate a risk, which two factors do you consider?

A Likelihood and impact

B Cost and speed of the development team

5. A public Wi-Fi network is used to access the production database, and customer records are stored there. Which rating is the most reasonable?

A High: an attack is likely and the impact on confidential data would be severe

B Low: because the Wi-Fi network is only used some of the time

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Practice: "All developers share one admin login"		APractice: plain text passwords -> Vulnerability: stolen database exposes every password
2Risk: Likelihood = High, Impact = Severe		BA current practice that departs from secure practice (least privilege and individual accounts), so it is a gap to flag as a vulnerability
3Link a practice to a vulnerability: the case study says passwords are stored as plain text, which departs from secure practice		CThis describes a secure practice, not a gap. A vulnerability must come from a current practice that falls short of secure practice.
4Link a vulnerability to a risk: a weakness only becomes a risk when a threat could exploit it and cause harm		DA rating of a risk that is both likely to happen and very damaging, so it should be treated as a top priority
5Vulnerability: "The company has a firewall"		EVulnerability: no input validation -> Risk: SQL injection leads to a data breach
6Risk rating: Likelihood = Low, Impact = Low, so fix this first		FThe rating and the priority do not match. A low likelihood and low impact risk is a low priority and should be treated after higher rated risks.

Definitions

gap analysis

Fill in the Blanks

Complete each line of code by filling in the missing parts.

__ practice ≠ securePractice THEN vulnerability ← true END IF

riskScore ← __________ * impact

riskScore ← likelihood _ impact

IF riskScore _ 12 THEN treatFirst ← true END IF

FOR EACH practice __ caseStudyPractices COMPARE practice WITH securePractice END FOR

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A practice = "Shared login"

B gap = "No unique accounts"

C risk = "Lost backup tapes"

Question 2

A evidence = "Bugs found weekly"

B risk = "Buggy code goes live"

C likelihood = "Rare"

Question 3

A practice = "Unpatched server"

B gap = "Software is up to date"

C risk = "Exploit by attackers"

D impact = "High"

Question 4

A practice = "MFA enforced"

B gap = "Poor credential care"

C risk = "Account takeover"

Question 5

A risk = "Customer data leaked"

B impact = "Minor"

C likelihood = "Possible"

D rating = "High"

Answer Key

Identifying vulnerabilities and risks from a case study

Section A: Quick Questions

B — Compare the practice with secure practice: shared, visible credentials weaken identity and access management

B — Vulnerability: no code review. Risk: insecure code is released and exploited, causing a data breach

A — Practice that creates a vulnerability (unpatched software)

A — Likelihood and impact

A — High: an attack is likely and the impact on confidential data would be severe

Section B: Match the Pairs

Practice: "All developers share one admin login" → A current practice that departs from secure practice (least privilege and individual accounts), so it is a gap to flag as a vulnerability

Risk: Likelihood = High, Impact = Severe → A rating of a risk that is both likely to happen and very damaging, so it should be treated as a top priority

Link a practice to a vulnerability: the case study says passwords are stored as plain text, which departs from secure practice → Practice: plain text passwords -> Vulnerability: stolen database exposes every password

Link a vulnerability to a risk: a weakness only becomes a risk when a threat could exploit it and cause harm → Vulnerability: no input validation -> Risk: SQL injection leads to a data breach

Vulnerability: "The company has a firewall" → This describes a secure practice, not a gap. A vulnerability must come from a current practice that falls short of secure practice.

Risk rating: Likelihood = Low, Impact = Low, so fix this first → The rating and the priority do not match. A low likelihood and low impact risk is a low priority and should be treated after higher rated risks.

Section C: Definitions

gap analysis — Comparing a case study's current practices with secure practice to find vulnerabilities, then rating the risk each gap creates by its likelihood and impact.

Section D: Fill in the Blanks

IF practice ≠ securePractice THEN
  vulnerability ← true
END IF

riskScore ← likelihood * impact

IF riskScore > 12 THEN
  treatFirst ← true
END IF

FOR EACH practice IN caseStudyPractices
  COMPARE practice WITH securePractice
END FOR

Section E: Spot the Error

C — The risk must follow from the gap. Having no unique accounts creates a risk of unauthorised access, not lost backup tapes.

C — The case study says bugs are found weekly, so the risk happens often. The likelihood should be high (almost certain), not rare.

B — An unpatched server is a gap because known flaws are left open. Saying the software is up to date contradicts the practice.

A — The current practice must be the weak one that creates the gap. Enforcing MFA is secure practice, so it would not lead to poor credential care.

B — Leaked customer data causes serious harm, such as privacy breaches, fines and lost trust. The impact should be severe, not minor.