Recommending and justifying improvements to development practices

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which is a well-formed recommendation for a company whose developers share one admin password?

A Improve security across the whole company as soon as possible

B Introduce role-based access control with MFA, because shared credentials are a weakness; this improves confidentiality and accountability

2. A recommendation should be linked to...

A An identified weakness found in the analysis of the organisation's practices

B Whichever security tool is newest or most popular

3. Which justification is stronger for recommending automated patch management?

A Everyone else is doing it so we should too

B It closes known vulnerabilities faster, supporting Essential Eight patching and reducing the chance of a breach

4. When prioritising several recommendations, which should usually come first?

A The fix for the weakness with the highest risk (high likelihood and high impact)

B The fix that is quickest to explain to staff

5. Which statement best balances cost and security when justifying a recommendation?

A The cost of staff training is small compared to the potential loss from a data breach and fines

B Security is important so cost does not need to be considered

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Recommendation: Introduce MFA for all repository accounts		AIt ignores cost. A justification must balance the cost against the security benefit and show the spend is reasonable for the risk reduced.
2Justification: Fixes weak logins; costs $4 per user per month; supports Essential Eight		BEncrypt customer data (APP 11, ISM). Target: 100% of databases encrypted within 3 months
3Recommendations are prioritised so that high-risk weaknesses with the biggest security gain are fixed first		CNames one specific improvement the organisation should make, rather than a vague idea like 'be more secure'
4A recommendation can be linked to legislation and frameworks, and its success can be measured		DPriority 1: Patch the unpatched server (risk: High) Priority 2: Update the staff induction guide (risk: Low)
5Recommendation: Improve security generally. Benefit: it will be better.		EThe recommendation is vague. It names no specific improvement, links to no identified weakness and gives no measurable benefit or criterion.
6Recommendation: Buy a $200,000 security suite. Cost: ignore, security matters most.		FLinks the improvement to a weakness and justifies it with its cost, benefit and the framework criterion it improves

Definitions

recommendation

Fill in the Blanks

Complete each line of code by filling in the missing parts.

weakness = "API key is hard-coded" ______________ = "Use a secrets manager" benefit = "Keys stay out of the repository"

weakness = "Customer data is not encrypted" recommendation = "Encrypt stored data" law = "Meets ______ (data security)"

cost = 500 loss = 20000 IF cost _ loss THEN approve = TRUE

IF risk = "Extreme" THEN ________ = 1 END IF

before = 12 after = 3 reduction = (before - after) / ______ * 100

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A Weakness: backups are tested

B Recommend: enforce MFA for all

C Benefit: blocks stolen logins

D Cost: $2 per user per month

Question 2

A Risk A: unencrypted DB (high)

B Risk B: old logo file (low)

C Rank by likelihood and impact

D Do the low risk fix first

Question 3

A Weakness: plain text user data

B Recommend: encrypt stored data

C Law: Copyright Act 1968

D Cost: $500 one-off setup

Question 4

A Asset value: $2,000,000 data

B Control cost: $9,000,000 a yr

C Cost is less than the loss

Question 5

A Target: make staff more aware

B Measure: monthly phishing test

C Baseline: 20% clicked in May

Answer Key

Recommending and justifying improvements to development practices

Section A: Quick Questions

B — Introduce role-based access control with MFA, because shared credentials are a weakness; this improves confidentiality and accountability

A — An identified weakness found in the analysis of the organisation's practices

B — It closes known vulnerabilities faster, supporting Essential Eight patching and reducing the chance of a breach

A — The fix for the weakness with the highest risk (high likelihood and high impact)

A — The cost of staff training is small compared to the potential loss from a data breach and fines

Section B: Match the Pairs

Recommendation: Introduce MFA for all repository accounts → Names one specific improvement the organisation should make, rather than a vague idea like 'be more secure'

Justification: Fixes weak logins; costs $4 per user per month; supports Essential Eight → Links the improvement to a weakness and justifies it with its cost, benefit and the framework criterion it improves

Recommendations are prioritised so that high-risk weaknesses with the biggest security gain are fixed first → Priority 1: Patch the unpatched server (risk: High) Priority 2: Update the staff induction guide (risk: Low)

A recommendation can be linked to legislation and frameworks, and its success can be measured → Encrypt customer data (APP 11, ISM). Target: 100% of databases encrypted within 3 months

Recommendation: Improve security generally. Benefit: it will be better. → The recommendation is vague. It names no specific improvement, links to no identified weakness and gives no measurable benefit or criterion.

Recommendation: Buy a $200,000 security suite. Cost: ignore, security matters most. → It ignores cost. A justification must balance the cost against the security benefit and show the spend is reasonable for the risk reduced.

Section C: Definitions

recommendation — A specific improvement linked to an identified weakness and justified by its benefits, its costs and the criteria it improves, such as laws, frameworks or measurable security.

Section D: Fill in the Blanks

weakness = "API key is hard-coded"
recommendation = "Use a secrets manager"
benefit = "Keys stay out of the repository"

weakness = "Customer data is not encrypted"
recommendation = "Encrypt stored data"
law = "Meets APP 11 (data security)"

cost = 500
loss = 20000
IF cost < loss THEN approve = TRUE

IF risk = "Extreme" THEN
  priority = 1
END IF

before = 12
after = 3
reduction = (before - after) / before * 100

Section E: Spot the Error

A — A recommendation must be linked to the weakness it fixes. Enforcing MFA does not address backups, so line 1 should name the missing MFA, for example 'Weakness: no MFA on the repo'.

D — Recommendations are prioritised by risk rating. The high risk fix must come first, because it reduces the most likelihood and impact for the money and time spent.

C — The Copyright Act covers creative works, not the security of personal information. A recommendation to encrypt stored data should link to APP 11 in the Privacy Act.

B — A control that costs far more than the asset it protects is not a balanced recommendation. Line 2 should show a cost of $20,000 a year, which is below the loss avoided.

A — Improvement must be measurable. 'More aware' cannot be checked, so the target should be a number, such as cutting bad clicks by 50%.