Title: The Systems Development Life Cycle
Course: IN 2001 Principle of Information Assurance > Section: Module 1: Chapter One

The Systems Development Life Cycle

Information security must be managed in a manner similar to any other major system implemented in the organization.

The best approach for implementing an information security system in an organization with little or no formal security in place is to use a variation of the systems development life cycle (SDLC): the security systems development life cycle (SecSDLC).

Methodology and Phases

The SDLC is a methodology for the design and implementation of an information system in an organization.

A methodology is a formal approach to solving a problem based on a structured sequence of procedures. Using a methodology ensures a rigorous process and avoids missing those steps that can lead to compromising the end goal.  The goal is to create a comprehensive security posture.

The entire process may be initiated in response to specific conditions or combinations of conditions.

The impetus to begin the SecSDLC may be event-driven, started in response to some occurrence or plan-driven as a result of a carefully developed implementation strategy.

At the end of each phase comes a structured review or “reality check” during which the team determines if the project should be continued, discontinued, outsourced or postponed until additional expertise or organizational knowledge is acquired.

Investigation

The first phase, investigation, is the most important.  What is the problem the system is being developed to solve? This phase begins with an examination of the event or plan that initiates the process.

The objectives, constraints, and scope of the project are specified.  A preliminary cost/benefit analysis is developed to evaluate the perceived benefits and the appropriate levels of cost an organization is willing to expend to obtain those benefits.

A feasibility analysis is performed to assess the economic, technical and behavioral feasibilities of the process and to ensure that implementation is worth the organization’s time and effort.

Analysis

The analysis phase begins with the information learned during the investigation phase.  This phase consists primarily of assessments of the organization, the status of current systems and the capability to support the proposed systems.

Analysts begin to determine what the new system is expected to do and how it will interact with existing systems.  The phase ends with the documentation of the findings and a feasibility analysis update.

Logical Design

In the logical design phase, the information gained from the analysis phase is used to begin creating a solution system for a business problem.

Then, based on the business need, applications capable of providing needed services are selected.  Based on the applications needed, data support and structures capable of providing the needed inputs are selected.

Finally, based on all of the above, specific technologies are selected to implement the physical solution. In the end, another feasibility analysis is performed.

Physical Design

During the physical design phase, specific technologies are selected to support the alternatives identified and evaluated in the logical design.

The selected components are evaluated based on a make-or-buy decision (develop in-house or purchase from a vendor).

Final designs integrate various components and technologies.

After yet another feasibility analysis, the entire solution is presented to the end-user representatives for approval.

Implementation

In the implementation phase, any needed software is created. Components are ordered, received and tested.

Afterwards, users are trained and supporting documentation is created.  Again, a feasibility analysis is prepared, and the users are presented with the system for a performance review and acceptance test.

Maintenance and Change

The maintenance and change phase is the longest and most expensive phase of the process.  This phase consists of the tasks necessary to support and modify the system for the remainder of its useful life cycle.

Even though formal development may conclude during this phase, the life cycle of the project continues until it is determined that the process should begin again from the investigation phase.  When the current system can no longer support the changed mission of the organization, the project is terminated and a new project is implemented.

Securing the Systems Development Life Cycle

Each of the phases of the SDLC should include consideration of the security of the system being assembled as well as the information it uses.  Such consideration means that each implementation of a system is secure and does not risk compromising the confidentiality, integrity and availability of the organization’s information assets.

NIST recommends that organizations incorporate the associated IT security steps of the included general SDLC into their development processes.  (See textbook pages 23-25) It is imperative that information security be designed into a system from its inception, rather than added in during or after the implementation phase.

Organizations are moving toward more security-focused development approaches, seeking to improve not only the functionality of the systems they have in place, but the confidence of the consumer in their product.