← VCE Software Development U4O2

Mitigation measures for threats, vulnerabilities and risks

An action that reduces or eliminates a specific threat, vulnerability or risk, such as a technical, process or people control matched to the risk it addresses.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 123, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 23

Understanding Mitigation measures for threats, vulnerabilities and risks in VCE Software Development U4O2

What it does: Phishing exploits human error, so the matching mitigation is a people measure that trains staff to spot and report suspicious emails. A mandatory review step is a process measure. It matches the risk of insecure code by catching flaws before release. Mitigation measures lower risk, and sometimes remove it, but no measure gives a guarantee of total security. Removing the vulnerable component entirely eliminates the risk it caused. Reducing the risk would mean the page still exists but its likelihood or impact is lowered, for example by adding a firewall. Technical measures are built into systems or software, like MFA. An induction session is a people measure, and it is less direct.

Common mistakes: A measure must match the risk it addresses. More storage does nothing about SQL injection. It should be a control such as validating input or using parameterised queries. A single = assigns a value, but the condition needs a comparison. It should be if risk == "phishing":.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Mitigation measures for threats, vulnerabilities and risks to a class →

This module's key terms are also in a printable crossword (Modules 97–130) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A developer's laptop is infected by malware delivered through a phishing email. Which mitigation measure best matches this risk?
Staff phishing awareness training combined with email filteringAdding more comments to the source code
Matches
Risk: stolen passwords. Mitigation: install a new monitor for each developer
↓
The measure does not match the risk. A monitor does nothing about stolen passwords. MFA or a password policy should be used.
Applying
Meanings
Term
mitigation measure
Meaning
An action that reduces or eliminates a specific threat, vulnerability or risk, such as a technical, process or people control matched to the risk it addresses.
Practice
risk ← "Weak passwords"
Testing
Gaps
Mitigation:
Check Answer
Spots
1risk = "SQL injection"
2measure = "buy more storage"

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Firefly' badge — Night Coder, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A developer's laptop is infected by malware delivered through a phishing email. Which mitigation measure best matches this risk?
A. Staff phishing awareness training combined with email filtering ✓
B. Adding more comments to the source code
A good mitigation measure is matched to the specific risk. Phishing is addressed by people controls (training) and technical controls (email filtering). Code comments do nothing to reduce this threat.
2. Which statement about a mitigation measure is correct?
A. It guarantees that a system can never be attacked
B. It reduces or eliminates a specific threat, vulnerability or risk ✓
Mitigation measures lower risk, and sometimes remove it, but no measure gives a guarantee of total security.
3. A team stops running an old, unused admin web page that has known flaws. Is this reducing or eliminating the risk?
A. Eliminating the risk, because the vulnerable page no longer exists ✓
B. Reducing the risk, because the vulnerable page still exists but is harder to reach
Removing the vulnerable component entirely eliminates the risk it caused. Reducing the risk would mean the page still exists but its likelihood or impact is lowered, for example by adding a firewall.
4. Which of these is a TECHNICAL mitigation measure for weak passwords?
A. Running a one-hour staff induction session
B. Enforcing multi-factor authentication on all accounts ✓
Technical measures are built into systems or software, like MFA. An induction session is a people measure, and it is less direct.
5. Which of these is a PROCESS mitigation measure for insecure code reaching production?
A. Requiring a peer code review before any code is merged ✓
B. Installing antivirus software on the web server
A process measure is a set procedure that people follow, such as mandatory peer review. Antivirus is a technical measure and does not target insecure code logic.

Match the Pairs

mitigation measure → An action that reduces or eliminates a specific threat, vulnerability or risk
technical measure → A mitigation built into software or systems, such as MFA, encryption or patching
A people measure that reduces the risk of staff being tricked by phishing emails → Run regular phishing awareness training for all developers
A process measure that reduces the risk of a vulnerability reaching production code → Require a peer code review before every merge
Risk: stolen passwords. Mitigation: install a new monitor for each developer → The measure does not match the risk. A monitor does nothing about stolen passwords. MFA or a password policy should be used.
Risk: unpatched software. Mitigation: eliminated because we plan to patch it next year → A future plan does not eliminate the risk. Only applying the patch removes the vulnerability. A schedule at best reduces the risk.

Key Term

mitigation measure
An action that reduces or eliminates a specific threat, vulnerability or risk, such as a technical, process or people control matched to the risk it addresses.

Fill in the Blanks

1. Risk: SQL injection Mitigation: input validation Type: technical
Hint: Type the technical control that checks and cleans data users enter before it reaches the database.
2. Risk: unused admin account Mitigation: delete the account Effect: eliminate
Hint: Type the word for a measure that removes the risk completely rather than just lowering it.
3. Risk: unreviewed code Mitigation: peer code review Type: process
Hint: Type the category of measure that is a set procedure or workflow the team follows.
4. Risk: staff fall for phishing Mitigation: security training Type: people
Hint: Type the category of measure that changes what staff know and how they behave.
5. Risk: stolen password Mitigation: add MFA Effect: reduce
Hint: Type the abbreviation for the extra login step that still protects an account if the password is stolen.

Spot the Error

Question 1
A risk = "SQL injection"
B measure = "buy more storage"
C kind = "technical"
D print(risk, measure, kind)
Line B — A measure must match the risk it addresses. More storage does nothing about SQL injection. It should be a control such as validating input or using parameterised queries.
Question 2
A def pick(risk):
B if risk = "phishing":
C return "train staff"
D return "review risk"
Line B — A single = assigns a value, but the condition needs a comparison. It should be if risk == "phishing":.
Question 3
A plan = {"SQLi": "validation"}
B risk = "SQLi"
C measure = plan[risk]
D print("Apply:", risk)
Line D — The program should show the chosen mitigation measure, not the risk. It should print measure so the student sees which control to apply.
Question 4
A kind = "technical"
B measure = "phishing training"
C print(kind, measure)
Line A — Training staff is a people measure, not a technical one. The first line should be kind = "people".
Question 5
A plan = {
B "phishing": "training",
C "malware" = "antivirus",
D "weak passwords": "MFA"
E }
Line C — Dictionary entries pair a key and a value with a colon, not =. The line should be "malware": "antivirus",

Student with a class code? Join your class →