SDLC: System Development Life Cycle

cs5493

SDLC Classical Model

• Linear Sequential – Aka waterfall model

SDLC

Example: Concept to Planning

SDLC Model Variants

• The classical SDLC model has been refined into more useful variants.

SDLC Refined Model

SDLC Sustainment Cycle

• Changes are required to sustain the system– Planning needed changes based on technology,

market forces, security requirements, etc.– Analysis of proposed changes on the system– Design and integration of changes into the system– Implement proposed changes (make it so!)– Maintenance (things break, need replacement,

obsolescence)

SDLC : Sustainment Loop (cycle)

SDLC Refined Model

SDLC Applied to Information Systems

NIST (Uncle Sam) recommends including security in all development stages of an information system.

NIST Information SDLC Phases

• Initiation Phase

SDLC Phases

• Initiation Phase• Acquisition/Development Phase

SDLC Phases

• Initiation Phase• Acquisition/Development Phase• Implementation Phase

SDLC Phases

• Initiation Phase• Acquisition/Development Phase• Implementation Phase• Operations/Maintenance Phase

SDLC Phases

1.Initiation Phase2.Acquisition/Development Phase3.Implementation Phase4.Operations/Maintenance Phase5.Disposition Phase

Information SDLC (Executive Summary)

SDLC Phases

1.Initiation Phase2. Acquisition/Development Phase3. Implementation Phase4. Operations/Maintenance Phase5. Disposition Phase

1. Initiation Phase

a) Security Categorizationb) Preliminary Risk Assessment

1. Initiation Phase

a) Security Categorization

Security categorization standards assist in the appropriate selection of security controls.

1. Initiation Phase

a) Security Categorization

Categorization levels can be labeled low, moderate, or high.

...later to be categorized into a CC EAL.(Common Criteria Evaluation Assurance Level)

1. Initiation Phase

b) Preliminary Risk Assessment

Analysis that identifies the protection requirements for the system.*

*This would also be used in the certification/accreditation process.

SDLC Phases

1. Initiation Phase

2.Acquisition/Development Phase3. Implementation Phase4. Operations/Maintenance Phase5. Disposition Phase

2. Acquisition/Development Phase

• Risk Assessment (overlap with the previous phase)

2. Acquisition/Development Phase

• Risk Assessment• Security Functional Requirements

2. Acquisition/Development Phase

• Risk Assessment• Security Functional Requirements• Security Assurance Requirements Analysis

2. Acquisition/Development Phase

• Risk Assessment• Security Functional Requirements• Security Assurance Requirements Analysis• Cost Considerations & Reporting

2. Acquisition/Development Phase

• Risk Assessment• Security Functional Requirements• Security Assurance Requirements Analysis• Cost Considerations & Reporting• Security Planning

2. Acquisition/Development Phase

• Risk Assessment• Security Functional Requirements• Security Assurance Requirements Analysis• Cost Considerations & Reporting• Security Planning• Security Control Development

2. Acquisition/Development Phase

• Risk Assessment• Security Functional Requirements• Security Assurance Requirements Analysis• Cost Considerations & Reporting• Security Planning• Security Control Development• Developmental Security Test & Evaluation

2. Acquisition/Development Phase

a) Risk Assessmentb) Security Functional Requirementsc) Security Assurance Requirements Analysisd) Cost Considerations & Reportinge) Security Planningf) Security Control Developmentg) Developmental Security Test & Evaluationh) Other Components

2. a) Risk Assessment

• Overlaps with the previous phase: – identify the protection requirements for the

system .

2. b) Security Functional Requirements Analysis

• Should include consideration of relevant laws and regulations.

• This applies to • Government agencies• Companies with government contracts• Payment card industry laws and regulations• etc

2. c) Security Assurance Requirements Analysis

• The correct and effective use of security controls.– CC can be helpful here. Choose systems that have

been evaluated to meet an assurance standard.

2. d) Cost Considerations and Reporting

• Estimate the cost of information security over the life-cycle of the system.

2. e) Security Planning

• The agreed security controls, planned or in place, are fully documented.

2. f) Security Control Development

1. New systems : the security plan includes provisions for development of security controls. (Sustainability cycle)

2. Existing systems : implies the advancement of the security controls, especially those that are ineffective. (Sustainability cycle)

2. g) Developmental Security Testing and Evaluation

• An assurance that the security controls for a new system are: – Implemented correctly– Operate as intended– Produce the desired outcome

(as in certification and accreditation…)

2. h) Other Planning Components

• Examples:– Participation of all the relevant groups &

individuals in the security planning process.*• *This would include among others, such individuals as

the Certification Agent and Information System Owner.

SDLC Phases

1. Initiation Phase2. Acquisition/Development Phase

3.Implementation Phase4. Operations/Maintenance Phase5. Disposition Phase

3. Implementation Phase

• Inspection & Acceptance

3. Implementation Phase

• Inspection & Acceptance• Security Control Integration

3. Implementation Phase

• Inspection & Acceptance• Security Control Integration• Security Certification

3. Implementation Phase

a)Inspection & Acceptanceb)Security Control Integrationc) Security Certificationd)Security Accreditation

3. a) Inspection & Acceptance

• Validate that the documented functionality is actually implemented.

3. b) Security Control Integration

• The security controls are integrated at the operational site where the information system is deployed for operation.

3. c) Security Certification

• Certification occurs when security controls are– Implemented correctly,– Operate as intended; and,– Produce the desired outcome.

(As determined by the Certification Agent)

3. d) Security Accreditation

• The Authorizing Official (AO) will determine if the risks are acceptable for the information system.

SDLC Phases

1. Initiation Phase2. Acquisition/Development Phase3. Implementation Phase

4.Operations/Maintenance Phase5. Disposition Phase

4. Operations Maintenance Phase

• Configuration Management Control

4. Operations Maintenance Phase

a)Configuration Management & Controlb)Continuous Monitoring

4. a) Configuration Management & Control

• Consideration of how changes to the system will impact the overall security.– Changes could be updates and patches to the OS

and other software systems– Changes could be replacing failed or obsolete

hardware.

4. b) Continuous Monitoring

• Security controls are monitored through periodic testing and evaluation to ensure they work as intended.

SDLC Phases

1. Initiation Phase2. Acquisition/Development Phase3. Implementation Phase4. Operations/Maintenance Phase

5.Disposition Phase

5. Disposition Phase

• Information Preservation

5. Disposition Phase

• Information Preservation• Media Sanitization

5. Disposition Phase

a) Information Preservationb) Media Sanitizationc) Hardware & Software Disposal

5. a) Information Preservation

• Ensures information is retained as necessary and accommodates technology changes that may render current retrieval methods as obsolete.

5. b) Media Sanitization

• Data destined for disposal is properly erased.

5. c) Hardware & Software Disposal

• Hardware and software is disposed of in accordance with regulations, license agreements, laws, and agency policies.

FIN

Development/Acquisition Phase

• Security requirements shall be developed at the same time system planners define the requirements of the system.

Development/Acquisition Phase

• Security requirements shall be developed at the same time system planners define the requirements of the system.

• The security requirements shall be incorporated into design specifications along with assurances that the security features acquired can and do work correctly and effectively

Implementation Phase

• The system's security features shall be configured and enabled

Implementation Phase

• The system's security features shall be configured and enabled

• The system shall be tested and installed or fielded and the system authorized for processing.

Operation/Maintenance Phase

• Complete the many security activities outlined in the various rules of the system.

Operation/Maintenance Phase

• Complete the many security activities outlined in the various rules of the system.

• Perform backups, hold training classes, password management, review the system are just some examples

Disposal Phase

• Information may be moved to another system, archived, discarded or destroyed.

Disposal Phase

• Information may be moved to another system, archived, discarded or destroyed.

• Hardware and software can be sold, given away or discarded. – There is rarely a need to destroy hardware accept

for some storage media containing confidential information that cannot be sanitized without destruction

Disposal Phase

• Information may be moved to another system, archived, discarded or destroyed.

• Hardware and software can be sold, given away or discarded.

• The disposition of software needs to be in keeping with its license or other agreements