Title: The Security Systems Development Life Cycle
Course: IN 2001 Principle of Information Assurance > Section: Module 1: Chapter One

The Security Systems Development Life Cycle

The same phases used in the traditional SDLC can be adapted to support the specialized implementation of a security project.

The fundamental process is the identification of specific threats and the creation of specific controls to counter those threats.  The SecSDLC unifies the process and makes it a coherent program rather than a series of random, seemingly unconnected actions.

Investigation

The investigation of the SecSDLC begins with a directive from upper management, dictating the process, outcomes and goals of the project, as well as the constraints placed on the activity.  Frequently, this phase begins with an enterprise information security policy (EISP) that outlines the implementation of security.

Teams of responsible managers, employees and contractors are organized; problems are analyzed; and the scope is defined, including goals, objectives and constraints not covered in the program policy.

Finally, an organizational feasibility analysis is performed to determine whether the organization has the resources and commitment necessary to conduct a successful security analysis and design.

Analysis

In the analysis phase, the documents from the investigation phase are studied.  The development team conducts a preliminary analysis of existing security policies or programs, along with documented current threats and associated controls.

This phase also includes an analysis of relevant legal issues that could impact the design of the security solution.

The risk management task—identifying, assessing and evaluating the levels of risk facing the organization—also begins in this stage.

Logical Design

The logical design phase creates and develops the blueprints for security and examines and implements key policies that influence later decisions.  Also at this stage, critical planning is developed for incident response actions to be taken in the event of partial or catastrophic loss.  Next, a feasibility analysis determines whether or not the project should continue or be outsourced.

Physical Design

In the physical design phase, the security technology needed to support the blueprint outlined in the logical design is evaluated, alternative solutions are generated and a final design is agreed upon.

The security blueprint may be revisited to keep it synchronized with the changes needed when the physical design is completed.

Criteria needed to determine the definition of successful solutions is also prepared during this phase.

Included at this time are the designs for physical security measures to support the proposed technological solutions.

At the end of this phase, a feasibility study should determine the readiness of the organization for the proposed project and then the champion and users are presented with the design.  At this time, all parties involved have a chance to approve the project before implementation begins.

Implementation

The implementation phase is similar to the traditional SDLC.

The security solutions are acquired (made or bought), tested, implemented and tested again.

Personnel issues are evaluated and specific training and education programs are conducted.

Finally, the entire tested package is presented to upper management for final approval.

Maintenance and Change

The maintenance and change phase, though last, is perhaps the most important, given the high level of ingenuity in today’s threats.

The reparation and restoration of information is a constant duel with an often unseen adversary.

As new threats emerge and old threats evolve, the information security profile of an organization requires constant adaptation to prevent threats from successfully penetrating sensitive data.