SDLC: System Development Life Cycle

SDLC: System Development Life Cycle cs5493

SDLC Classical Model • Linear Sequential • Aka waterfall model

SDLC

Example: Concept to Planning

SDLC Model Variants • The classical SDLC model has been refined into more useful variants.

SDLC Refined Model

SDLC Sustainment Cycle • Changes are required to sustain the system • Planning needed changes based on technology, market forces, security requirements, etc. • Analysis of proposed changes on the system • Design and integration of changes into the system • Implement proposed changes (make it so!) • Maintenance (things break, need replacement, obsolescence)

SDLC : Sustainment Loop (cycle)

SDLC Refined Model

SDLC Applied to Information Systems NIST (Uncle Sam) recommends including security in all development stages of an information system.

NIST Information SDLC Phases • Initiation Phase

SDLC Phases • Initiation Phase • Acquisition/Development Phase

SDLC Phases • Initiation Phase • Acquisition/Development Phase • Implementation Phase

SDLC Phases • Initiation Phase • Acquisition/Development Phase • Implementation Phase • Operations/Maintenance Phase

SDLC Phases • Initiation Phase • Acquisition/Development Phase • Implementation Phase • Operations/Maintenance Phase • Disposition Phase

Information SDLC (Executive Summary)

1. Initiation Phase • Security Categorization • Preliminary Risk Assessment

1. Initiation Phase • Security Categorization • Security categorization standards assist in the appropriate selection of security controls.

1. Initiation Phase • Security Categorization • Categorization levels can be labeled low, moderate, or high. • ...later to be categorized into a CC EAL. • (Common Criteria Evaluation Assurance Level)

1. Initiation Phase • b) Preliminary Risk Assessment • Analysis that identifies the protection requirements for the system.* • *This would also be used in the certification/accreditation process.

2. Acquisition/Development Phase • Risk Assessment (overlap with the previous phase)

2. Acquisition/Development Phase • Risk Assessment • Security Functional Requirements

2. Acquisition/Development Phase • Risk Assessment • Security Functional Requirements • Security Assurance Requirements Analysis

2. Acquisition/Development Phase • Risk Assessment • Security Functional Requirements • Security Assurance Requirements Analysis • Cost Considerations & Reporting

2. Acquisition/Development Phase • Risk Assessment • Security Functional Requirements • Security Assurance Requirements Analysis • Cost Considerations & Reporting • Security Planning

2. Acquisition/Development Phase • Risk Assessment • Security Functional Requirements • Security Assurance Requirements Analysis • Cost Considerations & Reporting • Security Planning • Security Control Development

2. Acquisition/Development Phase • Risk Assessment • Security Functional Requirements • Security Assurance Requirements Analysis • Cost Considerations & Reporting • Security Planning • Security Control Development • Developmental Security Test & Evaluation

2. Acquisition/Development Phase • Risk Assessment • Security Functional Requirements • Security Assurance Requirements Analysis • Cost Considerations & Reporting • Security Planning • Security Control Development • Developmental Security Test & Evaluation • Other Components

2. a) Risk Assessment • Overlaps with the previous phase: • identify the protection requirements for the system .

2. b) Security Functional Requirements Analysis • Should include consideration of relevant laws and regulations. • This applies to • Government agencies • Companies with government contracts • Payment card industry laws and regulations • etc

2. c) Security Assurance Requirements Analysis • The correct and effective use of security controls. • CC can be helpful here. Choose systems that have been evaluated to meet an assurance standard.

2. d) Cost Considerations and Reporting • Estimate the cost of information security over the life-cycle of the system.

2. e) Security Planning • The agreed security controls, planned or in place, are fully documented.

2. f) Security Control Development 1. New systems : the security plan includes provisions for development of security controls. (Sustainability cycle) 2. Existing systems : implies the advancement of the security controls, especially those that are ineffective. (Sustainability cycle)

2. g) Developmental Security Testing and Evaluation • An assurance that the security controls for a new system are: • Implemented correctly • Operate as intended • Produce the desired outcome • (as in certification and accreditation…)

2. h) Other Planning Components • Examples: • Participation of all the relevant groups & individuals in the security planning process.* • *This would include among others, such individuals as the Certification Agent and Information System Owner.

3. Implementation Phase • Inspection & Acceptance

3. Implementation Phase • Inspection & Acceptance • Security Control Integration

3. Implementation Phase • Inspection & Acceptance • Security Control Integration • Security Certification

3. Implementation Phase • Inspection & Acceptance • Security Control Integration • Security Certification • Security Accreditation

3. a) Inspection & Acceptance • Validate that the documented functionality is actually implemented.

3. b) Security Control Integration • The security controls are integrated at the operational site where the information system is deployed for operation.

3. c) Security Certification • Certification occurs when security controls are • Implemented correctly, • Operate as intended; and, • Produce the desired outcome. (As determined by the Certification Agent)

3. d) Security Accreditation • The Authorizing Official (AO) will determine if the risks are acceptable for the information system.

4. Operations Maintenance Phase • Configuration Management Control

4. Operations Maintenance Phase • Configuration Management & Control • Continuous Monitoring

SDLC: System Development Life Cycle