← VCE Software Development U4O2

Recommending and justifying improvements to development practices

A specific improvement linked to an identified weakness and justified by its benefits, its costs and the criteria it improves, such as laws, frameworks or measurable security.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 130

Understanding Recommending and justifying improvements to development practices in VCE Software Development U4O2

What it does: Ranking recommendations by risk and impact lets a limited budget and time go to the most serious weaknesses first. Naming the law or framework (APP 11, ISM) shows the compliance criterion improved, and a numeric target makes the improvement measurable. A strong recommendation names a specific improvement, links it to the identified weakness and justifies it with the criteria it improves. Vague advice like 'improve security' does neither. Recommendations must respond to evidence of a weakness. Choosing a tool because it is trendy has no justification. Linking a recommendation to a framework such as the Essential Eight and to a reduced risk gives a credible justification.

Common mistakes: A recommendation must be linked to the weakness it fixes. Enforcing MFA does not address backups, so line 1 should name the missing MFA, for example 'Weakness: no MFA on the repo'. Recommendations are prioritised by risk rating. The high risk fix must come first, because it reduces the most likelihood and impact for the money and time spent.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Recommending and justifying improvements to development practices to a class →

This module's key terms are also in a printable crossword (Modules 97–130) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which is a well-formed recommendation for a company whose developers share one admin password?

Introduce role-based access control with MFA, because shared credentials are a weakness; this improves confidentiality and accountabilityImprove security across the whole company as soon as possible

Matches

Recommendation: Improve security generally. Benefit: it will be better.

↓

The recommendation is vague. It names no specific improvement, links to no identified weakness and gives no measurable benefit or criterion.

Applying

Meanings

Term

recommendation

Meaning

A specific improvement linked to an identified weakness and justified by its benefits, its costs and the criteria it improves, such as laws, frameworks or measurable security.

Practice

Weakness: API keys are hard-coded in source

Testing

Gaps

= "Use a secrets manager"

Check Answer

Spots

1Weakness: backups are tested

2Recommend: enforce MFA for all

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which is a well-formed recommendation for a company whose developers share one admin password?

A. Improve security across the whole company as soon as possible

B. Introduce role-based access control with MFA, because shared credentials are a weakness; this improves confidentiality and accountability ✓

A strong recommendation names a specific improvement, links it to the identified weakness and justifies it with the criteria it improves. Vague advice like 'improve security' does neither.

2. A recommendation should be linked to...

A. An identified weakness found in the analysis of the organisation's practices ✓

B. Whichever security tool is newest or most popular

Recommendations must respond to evidence of a weakness. Choosing a tool because it is trendy has no justification.

3. Which justification is stronger for recommending automated patch management?

A. Everyone else is doing it so we should too

B. It closes known vulnerabilities faster, supporting Essential Eight patching and reducing the chance of a breach ✓

Linking a recommendation to a framework such as the Essential Eight and to a reduced risk gives a credible justification.

4. When prioritising several recommendations, which should usually come first?

A. The fix for the weakness with the highest risk (high likelihood and high impact) ✓

B. The fix that is quickest to explain to staff

Prioritise using risk ratings. Address the highest likelihood and impact risks first, even if other fixes are easier.

5. Which statement best balances cost and security when justifying a recommendation?

A. The cost of staff training is small compared to the potential loss from a data breach and fines ✓

B. Security is important so cost does not need to be considered

A justification weighs the costs (money, time, effort) against the benefits (reduced risk and loss). Ignoring cost makes a recommendation unrealistic.

Match the Pairs

Recommendation: Introduce MFA for all repository accounts → Names one specific improvement the organisation should make, rather than a vague idea like 'be more secure'

Justification: Fixes weak logins; costs $4 per user per month; supports Essential Eight → Links the improvement to a weakness and justifies it with its cost, benefit and the framework criterion it improves

Recommendations are prioritised so that high-risk weaknesses with the biggest security gain are fixed first → Priority 1: Patch the unpatched server (risk: High) Priority 2: Update the staff induction guide (risk: Low)

A recommendation can be linked to legislation and frameworks, and its success can be measured → Encrypt customer data (APP 11, ISM). Target: 100% of databases encrypted within 3 months

Recommendation: Improve security generally. Benefit: it will be better. → The recommendation is vague. It names no specific improvement, links to no identified weakness and gives no measurable benefit or criterion.

Recommendation: Buy a $200,000 security suite. Cost: ignore, security matters most. → It ignores cost. A justification must balance the cost against the security benefit and show the spend is reasonable for the risk reduced.

Key Term

recommendation

A specific improvement linked to an identified weakness and justified by its benefits, its costs and the criteria it improves, such as laws, frameworks or measurable security.

Fill in the Blanks

1. weakness = "API key is hard-coded" recommendation = "Use a secrets manager" benefit = "Keys stay out of the repository"

Hint: Type the variable name that holds the specific improvement being proposed to fix the weakness.

2. weakness = "Customer data is not encrypted" recommendation = "Encrypt stored data" law = "Meets APP 11 (data security)"

Hint: Type the Australian Privacy Principle that covers securing personal information.

3. cost = 500 loss = 20000 IF cost < loss THEN approve = TRUE

Hint: Type the comparison operator showing the control costs less than the loss it prevents.

4. IF risk = "Extreme" THEN priority = 1 END IF

Hint: Type the variable that decides which recommendation is done first.

5. before = 12 after = 3 reduction = (before - after) / before * 100

Hint: Type the variable holding the starting value that the improvement is measured against.

Spot the Error

Question 1

A Weakness: backups are tested

B Recommend: enforce MFA for all

C Benefit: blocks stolen logins

D Cost: $2 per user per month

Line A — A recommendation must be linked to the weakness it fixes. Enforcing MFA does not address backups, so line 1 should name the missing MFA, for example 'Weakness: no MFA on the repo'.

Question 2

A Risk A: unencrypted DB (high)

B Risk B: old logo file (low)

C Rank by likelihood and impact

D Do the low risk fix first

Line D — Recommendations are prioritised by risk rating. The high risk fix must come first, because it reduces the most likelihood and impact for the money and time spent.

Question 3

A Weakness: plain text user data

B Recommend: encrypt stored data

C Law: Copyright Act 1968

D Cost: $500 one-off setup

Line C — The Copyright Act covers creative works, not the security of personal information. A recommendation to encrypt stored data should link to APP 11 in the Privacy Act.

Question 4

A Asset value: $2,000,000 data

B Control cost: $9,000,000 a yr

C Cost is less than the loss

Line B — A control that costs far more than the asset it protects is not a balanced recommendation. Line 2 should show a cost of $20,000 a year, which is below the loss avoided.

Question 5

A Target: make staff more aware

B Measure: monthly phishing test

C Baseline: 20% clicked in May

Line A — Improvement must be measurable. 'More aware' cannot be checked, so the target should be a number, such as cutting bad clicks by 50%.

Student with a class code? Join your class →