<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-AU" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi Sven,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Great question. Andrew has summed up the common expectations of students well. I would suggest that security needs to be a consideration at every stage of the PSM/SDLC.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">For instance, if we identify a requirement in the Analysis stage that a given application requires secure authentication that integrates with our client’s authentication schema. Then at the Design
stage I would suggest that we should be design the software solution such that the implementation is prescriptive. We might determine that our client uses multi-factor authentication backed by active directory and design a solution that authenticates via an
OATH token or other method that active directory supports. If we left this decision for the implementation stage we might go and design a login screen where it may not be necessary because we are able to do single sign-on or we may not have identified the
relevant dependencies for interaction with AD.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">For many students their client will stipulate that authentication is not required/desired and I think this is okay in some instances as long it is consider and documented at the analysis stage. In
this instance I still usually get students to think about the device(s) their client will use and how authentication on the device provides protection for their application data.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">For data protection I ask students to think about permissions for their files and databases as well as their backup strategy. If they document something related to their intended file formats or
backup strategy during U3O2 it makes U4O1 so much easier for them. At the simplest level knowing what files they need enables them to write relevant pseudocode.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Kind Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Bernie<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> sofdev <sofdev-bounces@edulists.com.au>
<b>On Behalf Of </b>Andrew Shortell<br>
<b>Sent:</b> Saturday, 26 February 2022 12:13 PM<br>
<b>To:</b> Year 12 Software Development Teachers' Mailing List <sofdev@edulists.com.au><br>
<b>Subject:</b> Re: [Year 12 SofDev] Security considerations influencing the design of solutions<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="mso-element:para-border-div;border:solid #9C6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt;background:#FFEB9C">
<p align="center" style="text-align:center;background:#FFEB9C;border:none;padding:0cm">
<b><span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:black">CAUTION:</span></b><span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:black"> This email originated from outside of KEW HIGH SCHOOL. Do not click links or open attachments
unless you recognize the sender and know the content is safe.<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal">Hi Sven <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">login - authentication<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">back ups security<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">safe saving<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">From a design point of view: Login<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">The student needs to show understanding in the report BUT in the design they only need the screen(s)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">the psuedo code can just go straight through - need to demonstrate understanding of NEED for security<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Also security of data - when doing delete student needs to ensure that the actual delete is not just a single click and it is gone<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">usually I have students hit delete then another button appears labelled something like “this will be gone for ever. Push me to destroy the data” and another button labelled “No NO I was wrong Save me from this”<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Many students like the humour of the interface<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Message boxes are so irritating that they often prevent bad moves but personally I have never liked them<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Andrew<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">CRT a little bit<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On 26 Feb 2022, at 11:59 am, 7 <<a href="mailto:7@7u7.org">7@7u7.org</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hi <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Sofdev key knowledge for Unit 3 outcome 1 #14 says:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><i>Security considerations influencing the design of Solutions, including authentication...</i><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">For authentication, I thought of hashes or checksums to verify the integrity of downloads, but this is not a design issue, is it? It would be implementation or something.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">So what exactly is the study design aiming for kids to study here?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hope someone can help<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Sven<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
<a href="http://www.edulists.com.au">http://www.edulists.com.au</a> - FAQ, Subscribe, Unsubscribe<br>
IT Software Development Mailing List <o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<br>
<br>
<hr style="border-top: 1px solid #bbb; ">
IMPORTANT - This email and any attachments may be confidential. If received in error, please contact us and delete all copies. Before opening or using attachments check them for viruses and defects. Regardless of any loss, damage or consequence, whether caused
by the negligence of the sender or not, resulting directly or indirectly from the use of any attached files our liability is limited to resupplying any affected attachments. Any representations or opinions expressed are those of the individual sender, and
not necessarily those of the Department of Education and Training.
</body>
</html>