Principle of Information System Security : Security System Development Life Cycle

INTRODUCTION:

The Security System Development Life Cycle (SSDLC) is a framework used to manage the development, maintenance, and retirement of an organization’s information security systems. The SSDLC is a cyclical process that includes the following phases:

1. Planning: During this phase, the organization identifies its information security needs and develops a plan to meet those needs. This may include identifying potential security risks and vulnerabilities, and determining the appropriate controls to mitigate those risks.
2. Analysis: During this phase, the organization analyzes its information security needs in more detail and develops a detailed security requirements specification.
3. Design: During this phase, the organization designs the security system to meet the requirements developed in the previous phase. This may include selecting and configuring security controls, such as firewalls, intrusion detection systems, and encryption.
4. Implementation: During this phase, the organization develops, tests, and deploys the security system.
5. Maintenance: After the security system has been deployed, it enters the maintenance phase, where it is updated, maintained, and tweaked to meet the changing needs of the organization.
6. Retirement: Eventually, the security system will reach the end of its useful life and will need to be retired. During this phase, the organization will plan for the replacement of the system, and ensure that data stored in it is properly preserved.

The SSDLC is a useful framework for managing the development, maintenance, and retirement of an organization’s information security systems. It helps to ensure that security systems meet the needs of the organization and are developed in a structured and controlled manner. This can help organizations to protect their sensitive information, maintain compliance with relevant regulations, and keep their data and systems safe from cyber threats.

Security System Development Life Cycle (SecSDLC) is defined as the set of procedures that are executed in a sequence in the software development cycle (SDLC). It is designed such that it can help developers to create software and applications in a way that reduces the security risks at later stages significantly from the start. The Security System Development Life Cycle (SecSDLC) is similar to Software Development Life Cycle (SDLC), but they differ in terms of the activities that are carried out in each phase of the cycle. SecSDLC eliminates security vulnerabilities. Its process involves identification of certain threats and the risks they impose on a system as well as the needed implementation of security controls to counter, remove and manage the risks involved. Whereas, in the SDLC process, the focus is mainly on the designs and implementations of an information system. Phases involved in SecSDLC are:

• System Investigation: This process is started by the officials/directives working at the top level management in the organization. The objectives and goals of the project are considered priorly in order to execute this process. An Information Security Policy is defined which contains the descriptions of security applications and programs installed along with their implementations in organization’s system.
• System Analysis: In this phase, detailed document analysis of the documents from the System Investigation phase are done. Already existing security policies, applications and software are analyzed in order to check for different flaws and vulnerabilities in the system. Upcoming threat possibilities are also analyzed. Risk management comes under this process only.
• Logical Design: The Logical Design phase deals with the development of tools and following blueprints that are involved in various information security policies, their applications and software. Backup and recovery policies are also drafted in order to prevent future losses. In case of any disaster, the steps to take in business are also planned. The decision to outsource the company project is decided in this phase. It is analyzed whether the project can be completed in the company itself or it needs to be sent to another company for the specific task.
• Physical Design: The technical teams acquire the tools and blueprints needed for the implementation of the software and application of the system security. During this phase, different solutions are investigated for any unforeseen issues which may be encountered in the future. They are analyzed and written down in order to cover most of the vulnerabilities that were missed during the analysis phase.
• Implementation: The solution decided in earlier phases is made final whether the project is in-house or outsourced. The proper documentation is provided of the product in order to meet the requirements specified for the project to be met. Implementation and integration process of the project are carried out with the help of various teams aggressively testing whether the product meets the system requirements specified in the system documentation.
• Maintenance: After the implementation of the security program it must be ensured that it is functioning properly and is managed accordingly. The security program must be kept up to date accordingly in order to counter new threats that can be left unseen at the time of design.

ADVANTAGES OR DISADVANTAGES:

Advantages of using the Security System Development Life Cycle (SSDLC) framework include:

1. Improved security: By following the SSDLC, organizations can ensure that their information security systems are developed, maintained and retired in a controlled and structured manner, which can help to improve overall security.
2. Compliance: The SSDLC can help organizations to meet compliance requirements, by ensuring that security controls are implemented to meet relevant regulations.
3. Risk management: The SSDLC provides a structured and controlled approach to managing information security risks, which can help to identify and mitigate potential risks.
4. Better project management: The SSDLC provides a structured and controlled approach to managing information security projects, which can help to improve project management and reduce risks.
5. Increased efficiency: By following the SSDLC, organizations can ensure that their resources are used efficiently, by ensuring that the development, maintenance and retirement of information security systems is planned and managed in a consistent and controlled manner.

Disadvantages of using the SSDLC framework include:

1. Cost: Implementing the SSDLC framework can be costly, as it may require additional resources, such as security experts, to manage the process.
2. Time-consuming: The SSDLC is a cyclical process that involves multiple phases, which can be time-consuming to implement.
3. Complexity: The SSDLC process can be complex, especially for organizations that have not previously used this framework.
4. Inflexibility: The SSDLC is a structured process, which can make it difficult for organizations to respond quickly to changing security needs.
5. Limited Adaptability: The SSDLC is a predefined process, which is not adaptable to new technologies, it may require updating or revising to accommodate new technology.

REFERENCE :

Some popular references on the Security System Development Life Cycle (SSDLC) include:

1. “Security in Computing” by Charles P. Pfleeger and Shari Lawrence Pfleeger: This book provides an overview of the SSDLC and discusses how it can be used to develop secure systems.
2. “Information Security: A Strategic Approach” by Vincent LeVeque: This book provides an in-depth examination of the SSDLC and discusses how it can be used to manage information security risks.
3. “Software Security Engineering: A Guide for Project Managers” by Robert C. Seacord: This book provides an overview of the SSDLC and discusses how it can be used to develop secure software systems.
4. “The Security Development Lifecycle” by Michael Howard, Steve Lipner, and David LeBlanc: This book provides an in-depth examination of the SSDLC and discusses how it can be used to develop secure software systems.
5. “Information Security Management Handbook” by Harold F. Tipton and Micki Krause: This book provides an overview of the SSDLC and discusses how it can be used to manage information security risks.

“Information Security Governance: Concepts, Strategies, and Best Practices” by John R. Vacca: This book provides an overview of the SSDLC and discusses how it can be used to govern information security risks.

These are the steps that are involved in the SecSDLC cycle with their brief description.