Organisational Goals & Objectives and Software Security

A set of practice questions and answers covering organisational goals, software development models (In-house vs Outsourcing), cybersecurity threats (Malware, Social Engineering, MitM), security controls (IAM, Encryption, Version Control), and legislative frameworks like the Essential Eight.

What are organisational goals?

Broad statements that describe a future state or principle a business aims to achieve or uphold, working towards the organization's mission statement.

What is a mission statement?

An overarching summary of the values and aims of an organization, such as "To provide every student with a high quality education".

What specific characteristics must objectives have?

They must be measurable, quantifiable, realistic, and attainable within a specific timeline, acting as steps to achieve goals.

What is an example of a business objective?

"Increase sales by $15\%$ over the next 12 months".

What are the advantages of in-house software development?

More control and oversight, better security as data stays within the company, and closer alignment with specific organizational objectives.

What are the disadvantages of in-house software development?

Limited access to skilled workers, greater initial expenses for hiring and training, and internal staff being pulled away from other operations.

What are the advantages of outsourcing software development?

Greater access to skilled workers and expertise, and potentially lower labour costs if development is outsourced overseas.

What are the security risks associated with Application Programming Interfaces (APIs)?

Exposing endpoints, insufficient authentication and authorisation, lack of input validation, and security weaknesses introduced by third-party libraries.

What is the definition of Malware?

Malicious software designed to damage, disrupt, or gain unauthorized access to an information system.

How do viruses and worms differ according to the text?

Both are self-replicating malicious code, but viruses can modify, corrupt, or delete data specifically while spreading across systems.

What is a Logic bomb?

Malicious code that lies dormant until a specific trigger, such as a date or event, activates it to cause harm.

What is a Man-in-the-middle attack?

When a perpetrator intercepts communication between 2 communicating parties without their knowledge to obtain sensitive information.

What is the purpose of a Virtual Private Network (VPN) in mitigating communication attacks?

It masks a user's IP address to ensure secure connections.

What are the dangers of unpatched and outdated IT systems?

Cyberattack opportunities, non-compliance leading to fines, and system instability resulting in downtime and financial costs.

What is meant by 'Combined Environments' in software development?

A situation where development, testing, and production environments are not separated, allowing insecure or untested code to infiltrate live systems.

What is Social engineering?

The art of exploiting human psychology rather than technical hacking to gain access to buildings, systems, and data.

Define 'Phishing' and 'Pharming'.

Phishing is deceiving a victim into providing personal data, while pharming redirects users to false websites that imitate legitimate sites.

What is the 'Quid Pro Quo' social engineering attack?

Offering benefits to a victim in exchange for their personal data.

What is the difference between Malicious and Negligent insider threats?

Malicious threats involve deliberate acts for personal gain or harm, while negligent threats occur due to human error or carelessness, such as accidentally deleting files.

What is Identity & Access Management (IAM)?

The process of ensuring only authorised individuals have access to specific resources and systems, often using multi-factor authentication (MFA) and the principle of least privilege.

What is Version control?

A system used during development to record each change so developers can revert to previous versions if necessary, providing a full audit trail.

In the context of version control, what is Continuous Integration (CI)?

A practice where a central repository holds all updates, merging versions into a single master codebase certified against bugs and vulnerabilities.

What is the difference between Symmetric and Asymmetric encryption?

Symmetric uses the same key for encryption and decryption and is faster; Asymmetric uses a public key to encrypt and a private key to decrypt, offering enhanced security.

What are the four main principles of Threat Modelling?

1. Define security requirements; 2. Identify threats; 3. Mitigate threats; 4. Confirm if threats have been mitigated.

What are the eight strategies in the Essential Eight framework?

1. Application control; 2. Patch applications; 3. Restrict Microsoft Office macros; 4. User applications hardening; 5. Multi-factor authentication; 6. Patch operating systems; 7. Restrict administrative privileges; 8. Regular backups.

What are the five functions of the Information Security Manual (ISM) framework?

Govern, Identify, Protect, Detect, and Respond.

What are some ethical issues related to AI in software development?

Bias and discrimination, job displacement/redundancies, lack of transparency in automated decisions, and privacy risks from large-scale data collection.

What is the 5-step plan for Risk Management?

1. Identify the risk; 2. Analyse/Assess/Measure the risk; 3. Mitigate the risk; 4. Treat the risk; 5. Monitor/Review.