Medium and large organisations compared

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which is more likely to have a dedicated security team?

A A large organisation with many systems and staff

B A small business with a handful of staff

2. Which statement about formal policies is correct?

A Medium and large organisations usually rely on informal habits instead of written policies

B Medium and large organisations usually write formal policies and processes for software development

3. How does having more systems and users affect risk?

A It reduces risk because attacks are spread out

B It gives attackers more targets, so risk is harder to manage

4. Why can a large organisation afford more security measures?

A It generally has a bigger budget and more staff

B It has fewer systems to protect

5. Which describes how a large organisation manages software development risks?

A Formally, using documented processes and assigned roles

B Informally, with each developer deciding what to do

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1staffCount > 250		Asystems = 120 users = 50000
2securityTeam = "dedicated"		Bpolicy = "approved" reviewRequired = true
3Larger organisations run many systems and users, so more attack points need to be managed.		CFormal policies are needed when there are many users and systems, not just 5 users. The condition should test a large number of users.
4Larger organisations use formal written policies and processes that every developer must follow.		DA large organisation often has a dedicated security team whose full-time job is managing security risks.
5budget = "small" # large organisation		EA large organisation has many staff, so it can split software development, testing and security into separate teams.
6if users == 5: needFormalPolicy = true		FLarge organisations usually have bigger budgets, so they can pay for security tools, training and specialist staff. A small budget is the wrong description.

Definitions

Medium and large organisations

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF staff > 500 ___ budget > 1000000 THEN size ← "large" END IF

systems ← 12 systems ← systems _ 1 DISPLAY systems

hasTeam ← ____ IF hasTeam THEN DISPLAY "Team manages risks"

FOR i ← 1 __ systems APPLY formalPolicy(i) NEXT i

users ← 50000 __ users > 1000 THEN risk ← "high"

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A staff == 2500

B if staff >= 200:

C tier = "large"

D else:

E tier = "medium"

Question 2

A sys = 35

B users = 12000

C if sys > 20 and users > 5000

D attack_surface = "large"

Question 3

A has_policy = True

B if has_policy = True:

C print("Follow process")

Question 4

A team_size = 12

B alerts = 40

C if team_size > 0:

D each = team_size / alerts

Question 5

A budget = 500000

B security_spend = budget + 0.1

C print(security_spend)

Answer Key

Medium and large organisations compared

Section A: Quick Questions

A — A large organisation with many systems and staff

B — Medium and large organisations usually write formal policies and processes for software development

B — It gives attackers more targets, so risk is harder to manage

A — It generally has a bigger budget and more staff

A — Formally, using documented processes and assigned roles

Section B: Match the Pairs

staffCount > 250 → A large organisation has many staff, so it can split software development, testing and security into separate teams.

securityTeam = "dedicated" → A large organisation often has a dedicated security team whose full-time job is managing security risks.

Larger organisations run many systems and users, so more attack points need to be managed. → systems = 120 users = 50000

Larger organisations use formal written policies and processes that every developer must follow. → policy = "approved" reviewRequired = true

budget = "small" # large organisation → Large organisations usually have bigger budgets, so they can pay for security tools, training and specialist staff. A small budget is the wrong description.

if users == 5: needFormalPolicy = true → Formal policies are needed when there are many users and systems, not just 5 users. The condition should test a large number of users.

Section C: Definitions

Medium and large organisations — Organisations with more staff, bigger budgets, more systems and users, formal policies and dedicated security teams, so they manage software development and its risks more formally.

Section D: Fill in the Blanks

IF staff > 500 AND budget > 1000000 THEN
  size ← "large"
END IF

systems ← 12
systems ← systems + 1
DISPLAY systems

hasTeam ← TRUE
IF hasTeam THEN
  DISPLAY "Team manages risks"

FOR i ← 1 TO systems
  APPLY formalPolicy(i)
NEXT i

users ← 50000
IF users > 1000 THEN
  risk ← "high"

Section E: Spot the Error

A — A single = assigns a value. Using == compares instead, so staff is never set. It should be staff = 2500.

C — An if statement must end with a colon. The line should be if sys > 20 and users > 5000:

B — A condition needs the comparison operator == because a single = tries to assign. It should be if has_policy == True:

D — Alerts per security team member is alerts divided by team size. The division is the wrong way round. It should be each = alerts / team_size.

B — Spending 10% of the budget on security needs multiplication. Adding 0.1 only adds 10 cents. It should be budget * 0.1.