6G7V0030 1CWK100 Secure System Development Assessment Cover Sheet | MMU

6g7v0030 Learning Outcomes Being Assessed:

• LO1: Understand and apply the principles of privacy by design and security by design during enhanced practical systems development.
• LO2: Critically evaluate the maturity of secure systems development, including resilient information systems.
• LO3: Understanding of the trade-off between security risk with the cost of implementing security controls.
• LO4: Critically evaluate the repercussions on data privacy and adhere to legal and regulatory requirements with the major benchmarking tools to build security.
• LO5: Apply a wide range of transferable skills and attributes applicable to industry and research.

Assessment Mitigation

If there is a valid reason why you are unable to submit your assessment by the deadline, you may apply for Assessment Mitigation. There are two types of mitigation you can apply for via the module area on Moodle (in the ‘Assessments’ block on the right-hand side of the page):

• Non-evidenced extension: does not require you to submit evidence. It allows you to add a short extension to a deadline. This is not available for event-based assessments such as in-class tests, presentations, interviews, etc. You can apply for this extension during the assessment weeks, and the request must be made before the submission deadline. For this assessment, the non-evidenced extension is 2 days.
• Evidenced extension: requires you to provide independent evidence of a situation that has impacted you. Allows you to apply for a longer extension and is available for event-based assessment, such as in-class tests, presentations, interviews, etc. For event-based assessments, the normal outcome is that the assessment will be deferred to the summer reassessment period.

Assessment Introduction

This assessment is coursework-based and worth 100% of the overall unit mark. To complete the assessment, you must submit a practice journal. To do this, you will need to do the following:

Working as a team. Create a repository for a secure system. This should include the following:

• Readme.md file detailing your team and approach.
• Security requirements.
• Threat model.
• Program code for the secure system.
• Manual security code reviews.
• Support for security testing via continuous integration.

Working on your own. Collect evidence of key personal attributes and specialist skills that you have demonstrated and document them in your own personal practice journal.

Further details regarding the secure system you are expected to develop and assessment/submission instructions are described in the remainder of this specification. You should read this cover sheet in full.

Assessment Aims

This unit is broadly aligned to the “Secure System Development” specialism in the UK Cyber Security Council’s Career Framework. The job titles this specialism is based on include:

• Software (Security) Architect.
• Software Engineer.
• Application Security Engineer.
• DevSecOps Engineer.

Even if you have plans for a career outside of these specialisms, this unit aims to help you interact with developers and be a champion of secure development processes and practices. In the assessment, you will therefore be expected to work as a team and fulfil the requirements of the above job titles.

Assessment Scenario

In this assessment, you are tasked with supporting a small business that is aiming to digitalise its service offering and grow its business. This business is Scoops2Go.

Scoops2Go have been selling frozen treats since 2005. Traditionally, they have promoted and sold these treats through their physical store.

In 2020, Scoops2Go began exploring the possibility of a digital store. The plan was that customers could get Scoops2Go’s signature frozen treats delivered to their door.

Scoops2Go considered using existing services, such as Deliveroo and Just Eat, to offer their services digitally. However, after some consideration, the managing director decided there was an opportunity to scale up Scoops2Go and launch their own service focused on frozen treats.

Scoops2Go raised funding to develop a prototype service—Scoops2Go v0.1—and trialled this service in 2024. The small team that developed this prototype could not support the further development of the system due to a lack of funding.

Recently, Scoops2Go has raised a significant amount of additional funds and intends to build their prototype into a fully-fledged competitor to services like Deliveroo and Just Eat. You have been hired as part of a team to help make this vision a reality.

To be specific, you and your team have been tasked with building a secure REST API. This means you are expected to do the following:

Working as a team: Develop a repository containing a secure REST API (you will be given a repository containing the prior work done towards Scoops2Go v0.1 as a starting point). Your updated repository should include:

• Readme.md file detailing your team and approach.
• Security requirements.
• Threat model.
• Program code for the secure REST API.
• Manual security code reviews.
• Support for security testing via continuous integration.

Working individually: A critical report reflecting on your experiences working in the team to develop a secure system. This should be written concerning your contributions to the team and detail ways you and the wider team could improve (much like a performance review).

Further information

Additional details regarding the assessment scenario will be made available each week in the labs. You and your team will be expected to make a start on aspects of the assessment in the labs (and continue working on the assessment outside of the labs if needed). It is therefore vital that you attend the labs.

Assessment Instructions

Naturally, you should work within your team to develop a repository containing a secure REST API before making a start on your individual critical report.

When working on your repository, it is very much left up to you and your team how you work. That said, the following assignment checklist provides some guidance as to what your team should be doing each week and should be used to help you stay on track – you will fall behind if you don’t attend the labs!

Additionally, I recommend writing the report incrementally as your progress through the lectures and labs (and of course doing at least one proofread!). Table 1 shows an assignment checklist mapped to each week of this unit.

Submission Instructions

Your submission should be in the form of a Word/PDF document. Your submission file should use the following naming convention: Firstname_Surname_StudentID (e.g., Sam_Attwood_12345678.docx).

Your submission should be created using the provided Practice_Journal_Template.docx as a starting point. Your submission should highlight evidence for key personal attributes and specialist skills with reference to your team’s shared repository (i.e., your group project).