CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Softwares and Software Security
A listed company's vendor delivered billing software that passed all functional tests. After deployment, an attacker exploited an unvalidated input field to access customer data. The failure is best traced to which SDLC lapse, and which legal consequence is most directly engaged under Indian law?
The lapse lies in requirements and testing, where security controls like input validation were neither specified nor tested. Under the IT Act, 2000, a body corporate negligent in maintaining reasonable security practices for sensitive personal data can be liable to pay compensation for resulting wrongful loss.
- AMaintenance-phase lapse only; the Information Technology Act, 2000 has no relevance to reasonable security practices
- BDeployment-phase lapse only; liability arises only if the vendor was a government body
- CRequirements and testing lapse in not specifying and testing security controls such as input validation; the body corporate may face compensation liability for failing to maintain reasonable security practices while handling sensitive personal dataCorrect
- DDesign-phase lapse only; liability can arise only under the Companies Act, 2013
Explanation
Input validation is a security requirement that should be defined early and verified in security testing; passing only functional tests missed it. Under the IT Act, 2000, a body corporate that is negligent in implementing reasonable security practices for sensitive personal data and causes wrongful loss can be liable to pay compensation. The other options wrongly limit the lapse to one phase or deny IT Act relevance.
Did you get it right without looking?
One question tells you little. A timed set on Softwares and Software Security shows your real accuracy, how long you take and where you lose marks.
More Softwares and Software Security questions
- Which international standard specifies requirements for establishing, implementing, maintaining and continually improving an Information Sec…
- A program copies more data into a fixed-size memory area than it can hold, overwriting adjacent memory and allowing an attacker to run injec…
- Under the Information Technology Act, 2000, a software developer in Pune deliberately inserts a hidden routine into a client's accounting so…
- Meridian Pay's team follows a secure software development life cycle. During the design phase, it systematically identifies assets, entry po…
- Which activity is characteristic of a secure SDLC, as distinct from an ordinary SDLC?
- A company secretary is told that a software team has finished writing code for a payroll module and now plans to run unit, integration and s…