# Unit 4 AOS2: Cybersecurity (Secure Software Development Practices) Welcome to your study of **Cybersecurity** for VCE Software Development. In Area of Study 2 (AOS2), you will examine the security risks associated with software development environments, analyze vulnerabilities, and investigate how organizations protect their software and data through threat modelling and mitigation strategies. --- ## Outcome 2 Overview > **Key Goal**: Analyze and evaluate the security of current development practices, examine threats using threat-modelling principles, and propose risk management plans to improve security. This module is divided into **16 core topics**: 10 representing vulnerabilities and risks, and 6 representing the security controls used to protect software and data. For a complete reference of definitions, laws, and security frameworks, you can also view the **[[Terminology|Cybersecurity Key Terminology Glossary]]**. --- ## Learning Roadmap Click on any of the topics below to open the dedicated study notes: ```mermaid graph TD Dashboard[Outcome 2: Cybersecurity] --> Vulns[Vulnerabilities & Risks] Dashboard --> Controls[Security Controls] Vulns --> Topic1[[Vulnerabilities and Risks/01 - Use of APIs|1. Use of APIs]] Vulns --> Topic2[[Vulnerabilities and Risks/02 - Malware|2. Malware]] Vulns --> Topic3[[Vulnerabilities and Risks/03 - Unpatched Software|3. Unpatched Software]] Vulns --> Topic4[[Vulnerabilities and Risks/04 - Poor Identity and Access Management|4. Poor IAM]] Vulns --> Topic5[[Vulnerabilities and Risks/05 - Man-in-the-Middle Attacks|5. MitM Attacks]] Vulns --> Topic6[[Vulnerabilities and Risks/06 - Insider Threats|6. Insider Threats]] Vulns --> Topic7[[Vulnerabilities and Risks/07 - Cyber Security Incidents|7. Security Incidents]] Vulns --> Topic8[[Vulnerabilities and Risks/08 - Software Acquired by Third Parties|8. Third-Party Risks]] Vulns --> Topic9[[Vulnerabilities and Risks/09 - Ineffective Code Review Practices|9. Ineffective Code Review]] Vulns --> Topic10[[Vulnerabilities and Risks/10 - Combined Dev Test and Prod Environments|10. Combined Environments]] Controls --> Topic11[[Security Controls/11 - Version Control and Code Repositories|11. Version Control]] Controls --> Topic12[[Security Controls/12 - Robust Identity and Access Management|12. Robust IAM]] Controls --> Topic13[[Security Controls/13 - Encryption|13. Encryption]] Controls --> Topic14[[Security Controls/14 - Code Review|14. Code Review]] Controls --> Topic15[[Security Controls/15 - Regular Updates and Patches to Software|15. Updates & Patches]] Controls --> Topic16[[Security Controls/16 - Separated Environments|16. Separated Environments]] style Dashboard fill:#2a3f5f,stroke:#fff,stroke-width:2px,color:#fff style Vulns fill:#4a1c1c,stroke:#fff,color:#fff style Controls fill:#1c4a24,stroke:#fff,color:#fff ``` ### Part A: Vulnerabilities and Risks 1. **[[Vulnerabilities and Risks/01 - Use of APIs|Use of Application Programming Interfaces (APIs)]]**: Protecting communication endpoints and preventing data leaks. 2. **[[Vulnerabilities and Risks/02 - Malware|Malware]]**: Understanding ransomware, spyware, Trojans, and how they compromise systems. 3. **[[Vulnerabilities and Risks/03 - Unpatched Software|Unpatched Software]]**: Managing vulnerabilities (CVEs) in operating systems and development tools. 4. **[[Vulnerabilities and Risks/04 - Poor Identity and Access Management|Poor Identity and Access Management (IAM)]]**: Authentication, Multi-Factor Authentication (MFA), and the Principle of Least Privilege. 5. **[[Vulnerabilities and Risks/05 - Man-in-the-Middle Attacks|Man-in-the-Middle (MitM) Attacks]]**: Protecting data in transit from eavesdropping and tampering. 6. **[[Vulnerabilities and Risks/06 - Insider Threats|Insider Threats]]**: Balancing trust, monitoring malicious acts, and minimizing human error. 7. **[[Vulnerabilities and Risks/07 - Cyber Security Incidents|Cyber Security Incidents]]**: Incident response phases (Preparation, Containment, Eradication, Recovery). 8. **[[Vulnerabilities and Risks/08 - Software Acquired by Third Parties|Third-Party Software Risks]]**: Managing supply chain vulnerabilities and open-source dependencies. 9. **[[Vulnerabilities and Risks/09 - Ineffective Code Review Practices|Ineffective Code Review Practices]]**: Implementing peer review, automated linting, and security audits. 10. **[[Vulnerabilities and Risks/10 - Combined Dev Test and Prod Environments|Combined Development, Testing & Production Environments]]**: The critical need for environment isolation and protecting production data. ### Part B: Security Controls 11. **[[Security Controls/11 - Version Control and Code Repositories|Version Control and Code Repositories]]**: Ensuring code integrity, change auditing, and branch protection. 12. **[[Security Controls/12 - Robust Identity and Access Management|Robust Identity and Access Management (IAM)]]**: Centralized access, Single Sign-On (SSO), and strong authentication standards. 13. **[[Security Controls/13 - Encryption|Encryption]]**: Safeguarding confidentiality for data at rest and data in transit. 14. **[[Security Controls/14 - Code Review|Code Review]]**: Leveraging peer check processes and automated SAST/DAST testing pipelines. 15. **[[Security Controls/15 - Regular Updates and Patches to Software|Regular Updates and Patches to Software]]**: Establishing update cycles and dependency monitoring. 16. **[[Security Controls/16 - Separated Environments|Separated Development, Testing, and Production Environments]]**: Structuring environment firewalls, deployment automation, and data sanitization. --- ## Core Cybersecurity Concepts Before diving into specific topics, make sure you understand these fundamental distinction areas, which are frequently assessed in VCE examinations. ### 1. Vulnerability vs. Risk * **Vulnerability**: A weakness or flaw in a software application, network, system, or environment that could be exploited by a threat actor (e.g., an unauthenticated API endpoint, a SQL injection flaw, or a weak password). * **Risk**: The probability that a vulnerability will be exploited, combined with the potential impact/damage it would cause to the organization. $\text{Risk} = \text{Threat} \times \text{Vulnerability} \times \text{Impact}$ ### 2. The STRIDE Threat Modelling Framework VCE Software Development requires you to understand how to apply threat-modelling principles. **STRIDE** is a standard industry framework used to classify threats: | Threat Category | Description | Security Attribute Violated | | :--- | :--- | :--- | | **S**poofing | Pretending to be someone or something else (e.g., fake login pages). | **Authenticity** | | **T**ampering | Modifying code, data, or communication in transit. | **Integrity** | | **R**epudiation | Claiming that an action was not performed (e.g., deleting logs). | **Non-repudiability** | | **I**nformation Disclosure | Exposing sensitive data to unauthorized parties. | **Confidentiality** | | **D**enial of Service | Preventing legitimate users from accessing the system. | **Availability** | | **E**levation of Privilege | Gaining administrative access without authorization. | **Authorization** | ### 3. Classification of Controls When designing a mitigation plan, you must propose controls. These are classified into three types: * **Physical Controls**: Tangible security measures (e.g., biometric door locks, security guards, server cages, backup tapes offsite). * **Software (Technical) Controls**: Code, encryption, or software tools (e.g., firewalls, MFA, encryption of data in transit, automated vulnerability scanners). * **Administrative (Organizational) Controls**: Policies, procedures, and training (e.g., employee cybersecurity training, code review policies, incident response plans, NDAs). --- > [!TIP] > **Study Suggestion**: As you read through each topic note, focus on identifying the **vulnerabilities** first, then consider the **risks/consequences** for an organization, and finally practice proposing a mix of **physical, software, and administrative controls** to mitigate those risks. --- ## Lesson Plans & Review Materials * **[[Lesson - Encryption Hashing and Code Review|Lesson Plan & Activities: Encryption, Hashing, and Code Review]]**: A 60-minute lesson outline featuring hooks, interactive envelope roleplay, and a code review exercise. * **[[Review Questions - Encryption Access and Version Control|Review Questions: Encryption, IAM, and Version Control]]**: A set of VCE-style multiple choice and short answer questions with a teacher marking guide.