VCE Software Development U4O2 Word Scramble: Threat modelling and evaluating security practices and Copyright, Essential Eight and the ISM (Modules 81–95)
Name:
Date:
Class:
🔤
Word scramble
Unscramble the letters and write each key term on the line.
1
KIRS ATENEMTTR
Matching each threat to a response chosen by its risk rating: eliminate it, reduce it, transfer it (e.g. insure) or accept it. High risks are treated first.
2
NAEOFVITRIIC NTTSGEI
Retesting a control after it is applied, using code review and security tests, to prove the threat is reduced, check no new weakness exists, note residual risk and record the evidence.
3
UAINVAELTO EITACRIR
Measurable standards, such as access control, code review, patching and training, used to judge how effective and compliant an organisation's development practices are.
4
AERT DNA UTFSIYJ
Judge a practice as met, partly met or not met against one criterion, then justify the rating by quoting evidence from the case study and explaining the consequence.
5
LYANIASGN A SECA TDUYS
Describe how the organisation builds software: who is involved, which environments and tools it uses, and which security controls it has, then spot gaps.
6
AGP YIASSNAL
Comparing a case study's current practices with secure practice to find vulnerabilities, then rating the risk each gap creates by its likelihood and impact.
7
AGRURLE UABPSCK
An Essential Eight strategy: keep tested, protected copies of data and code, made often, so work can be restored after loss, tampering or ransomware.
Answer Key
VCE Software Development U4O2 · Modules 81–95
1KIRS ATENEMTTR → Risk treatment — Matching each threat to a response chosen by its risk rating: eliminate it, reduce it, transfer it (e.g. insure) or accept it. High risks are treated first.
2NAEOFVITRIIC NTTSGEI → Verification testing — Retesting a control after it is applied, using code review and security tests, to prove the threat is reduced, check no new weakness exists, note residual risk and record the evidence.
3UAINVAELTO EITACRIR → evaluation criteria — Measurable standards, such as access control, code review, patching and training, used to judge how effective and compliant an organisation's development practices are.
4AERT DNA UTFSIYJ → rate and justify — Judge a practice as met, partly met or not met against one criterion, then justify the rating by quoting evidence from the case study and explaining the consequence.
5LYANIASGN A SECA TDUYS → Analysing a case study — Describe how the organisation builds software: who is involved, which environments and tools it uses, and which security controls it has, then spot gaps.
6AGP YIASSNAL → gap analysis — Comparing a case study's current practices with secure practice to find vulnerabilities, then rating the risk each gap creates by its likelihood and impact.
7AGRURLE UABPSCK → regular backups — An Essential Eight strategy: keep tested, protected copies of data and code, made often, so work can be restored after loss, tampering or ransomware.