SDLC: System Development Life
Cycle
cs5493
SDLC Classical Model
• Linear Sequential
– Aka waterfall model
SDLC
Example: Concept to Planning
SDLC Model Variants
• The classical SDLC model has been refined into
more useful variants.
SDLC Refined Model
SDLC Sustainment Cycle
• Changes are required to sustain the system
– Planning needed changes based on technology,
market forces, security requirements, etc.
– Analysis of proposed changes on the system
– Design and integration of changes into the system
– Implement proposed changes (make it so!)
– Maintenance (things break, need replacement,
obsolescence)
SDLC : Sustainment Loop (cycle)
SDLC Refined Model
SDLC Applied to Information Systems
NIST (Uncle Sam) recommends including
security in all development stages of an
information system.
NIST Information SDLC Phases
• Initiation Phase
SDLC Phases
• Initiation Phase
• Acquisition/Development Phase
SDLC Phases
• Initiation Phase
• Acquisition/Development Phase
• Implementation Phase
SDLC Phases
•
•
•
•
Initiation Phase
Acquisition/Development Phase
Implementation Phase
Operations/Maintenance Phase
SDLC Phases
1.Initiation Phase
2.Acquisition/Development Phase
3.Implementation Phase
4.Operations/Maintenance Phase
5.Disposition Phase
Information SDLC
(Executive Summary)
SDLC Phases
1.Initiation Phase
2. Acquisition/Development Phase
3. Implementation Phase
4. Operations/Maintenance Phase
5. Disposition Phase
1. Initiation Phase
a) Security Categorization
b) Preliminary Risk Assessment
1. Initiation Phase
a) Security Categorization
Security categorization standards assist in the
appropriate selection of security controls.
1. Initiation Phase
a) Security Categorization
Categorization levels can be labeled low,
moderate, or high.
...later to be categorized into a CC EAL.
(Common Criteria Evaluation Assurance Level)
1. Initiation Phase
b) Preliminary Risk Assessment
Analysis that identifies the protection
requirements for the system.*
*This would also be used in the certification/accreditation
process.
SDLC Phases
1. Initiation Phase
2.Acquisition/Development Phase
3. Implementation Phase
4. Operations/Maintenance Phase
5. Disposition Phase
2. Acquisition/Development Phase
• Risk Assessment (overlap with the previous phase)
2. Acquisition/Development Phase
• Risk Assessment
• Security Functional Requirements
2. Acquisition/Development Phase
• Risk Assessment
• Security Functional Requirements
• Security Assurance Requirements Analysis
2. Acquisition/Development Phase
•
•
•
•
Risk Assessment
Security Functional Requirements
Security Assurance Requirements Analysis
Cost Considerations & Reporting
2. Acquisition/Development Phase
•
•
•
•
•
Risk Assessment
Security Functional Requirements
Security Assurance Requirements Analysis
Cost Considerations & Reporting
Security Planning
2. Acquisition/Development Phase
•
•
•
•
•
•
Risk Assessment
Security Functional Requirements
Security Assurance Requirements Analysis
Cost Considerations & Reporting
Security Planning
Security Control Development
2. Acquisition/Development Phase
•
•
•
•
•
•
•
Risk Assessment
Security Functional Requirements
Security Assurance Requirements Analysis
Cost Considerations & Reporting
Security Planning
Security Control Development
Developmental Security Test & Evaluation
2. Acquisition/Development Phase
a) Risk Assessment
b) Security Functional Requirements
c) Security Assurance Requirements Analysis
d) Cost Considerations & Reporting
e) Security Planning
f) Security Control Development
g) Developmental Security Test & Evaluation
h) Other Components
2. a) Risk Assessment
• Overlaps with the previous phase:
– identify the protection requirements for the
system .
2. b) Security Functional Requirements Analysis
• Should include consideration of relevant laws
and regulations.
• This applies to
•
•
•
•
Government agencies
Companies with government contracts
Payment card industry laws and regulations
etc
2. c) Security Assurance Requirements Analysis
• The correct and effective use of security
controls.
– CC can be helpful here. Choose systems that have
been evaluated to meet an assurance standard.
2. d) Cost Considerations and Reporting
• Estimate the cost of information security over
the life-cycle of the system.
2. e) Security Planning
• The agreed security controls, planned or in
place, are fully documented.
2. f) Security Control Development
1. New systems : the security plan includes
provisions for development of security
controls. (Sustainability cycle)
2. Existing systems : implies the advancement of
the security controls, especially those that are
ineffective. (Sustainability cycle)
2. g) Developmental Security Testing and
Evaluation
• An assurance that the security controls for a
new system are:
– Implemented correctly
– Operate as intended
– Produce the desired outcome
(as in certification and accreditation…)
2. h) Other Planning Components
• Examples:
– Participation of all the relevant groups &
individuals in the security planning process.*
• *This would include among others, such individuals as
the Certification Agent and Information System Owner.
SDLC Phases
1. Initiation Phase
2. Acquisition/Development Phase
3.Implementation Phase
4. Operations/Maintenance Phase
5. Disposition Phase
3. Implementation Phase
• Inspection & Acceptance
3. Implementation Phase
• Inspection & Acceptance
• Security Control Integration
3. Implementation Phase
• Inspection & Acceptance
• Security Control Integration
• Security Certification
3. Implementation Phase
a)Inspection & Acceptance
b)Security Control Integration
c) Security Certification
d)Security Accreditation
3. a) Inspection & Acceptance
• Validate that the documented functionality is
actually implemented.
3. b) Security Control Integration
• The security controls are integrated at the
operational site where the information system
is deployed for operation.
3. c) Security Certification
• Certification occurs when security controls are
– Implemented correctly,
– Operate as intended; and,
– Produce the desired outcome.
(As determined by the Certification Agent)
3. d) Security Accreditation
• The Authorizing Official (AO) will determine if
the risks are acceptable for the information
system.
SDLC Phases
1. Initiation Phase
2. Acquisition/Development Phase
3. Implementation Phase
4.Operations/Maintenance Phase
5. Disposition Phase
4. Operations Maintenance Phase
• Configuration Management Control
4. Operations Maintenance Phase
a)Configuration Management & Control
b)Continuous Monitoring
4. a) Configuration Management & Control
• Consideration of how changes to the system
will impact the overall security.
– Changes could be updates and patches to the OS
and other software systems
– Changes could be replacing failed or obsolete
hardware.
4. b) Continuous Monitoring
• Security controls are monitored through
periodic testing and evaluation to ensure they
work as intended.
SDLC Phases
1. Initiation Phase
2. Acquisition/Development Phase
3. Implementation Phase
4. Operations/Maintenance Phase
5.Disposition Phase
5. Disposition Phase
• Information Preservation
5. Disposition Phase
• Information Preservation
• Media Sanitization
5. Disposition Phase
a) Information Preservation
b) Media Sanitization
c) Hardware & Software Disposal
5. a) Information Preservation
• Ensures information is retained as necessary
and accommodates technology changes that
may render current retrieval methods as
obsolete.
5. b) Media Sanitization
• Data destined for disposal is properly erased.
5. c) Hardware & Software Disposal
• Hardware and software is disposed of in
accordance with regulations, license
agreements, laws, and agency policies.
FIN
Development/Acquisition Phase
• Security requirements shall be developed at
the same time system planners define the
requirements of the system.
Development/Acquisition Phase
• Security requirements shall be developed at
the same time system planners define the
requirements of the system.
• The security requirements shall be
incorporated into design specifications along
with assurances that the security features
acquired can and do work correctly and
effectively
Implementation Phase
• The system's security features shall be
configured and enabled
Implementation Phase
• The system's security features shall be
configured and enabled
• The system shall be tested and installed or
fielded and the system authorized for
processing.
Operation/Maintenance Phase
• Complete the many security activities outlined
in the various rules of the system.
Operation/Maintenance Phase
• Complete the many security activities outlined
in the various rules of the system.
• Perform backups, hold training classes,
password management, review the system are
just some examples
Disposal Phase
• Information may be moved to another system,
archived, discarded or destroyed.
Disposal Phase
• Information may be moved to another system,
archived, discarded or destroyed.
• Hardware and software can be sold, given
away or discarded.
– There is rarely a need to destroy hardware accept
for some storage media containing confidential
information that cannot be sanitized without
destruction
Disposal Phase
• Information may be moved to another system,
archived, discarded or destroyed.
• Hardware and software can be sold, given
away or discarded.
• The disposition of software needs to be in
keeping with its license or other agreements