NSW HSC Software Engineering

## Why security is built in Software that handles other people's data becomes a target the moment it is deployed. **Secure software** is written so that the data it holds and the actions it allows are protected from people who should not have them, and it is treated as a requirement from the first day of a project rather than a patch added before release. The reason is cost and reach: a flaw found in design is a change to a diagram, while the same flaw found after installation means changing code, retesting, redeploying and, if data has already leaked, telling the people affected. The benefits fall into two groups. ### Data protection Most applications store something a person would not want exposed: names, addresses, payment details, health records, passwords, messages. Secure development protects this data while it is stored, while it moves between a user and a server, and while it is being processed. Protecting it keeps a business inside privacy law, keeps customers willing to hand the data over, and avoids the direct costs of a breach such as fines, compensation and the work of investigating what was taken. ### Minimising cyber attacks and vulnerabilities A **vulnerability** is a weakness that an attacker could use, such as a form field that accepts anything typed into it, and a **cyber attack** is an attempt to use one. Secure practices shrink the number of vulnerabilities that ship and make the ones that remain harder to use. An attacker looks for the easiest target…