Security Development Life Cycle and the Need for Testing Security Systems
Testing is not limited to software-based access controls. Every security system should be rigorously tested at each point in the development life cycle. Testing security systems requires an organization’s management and security team to anticipate possible scenarios that could circumvent the new security system, and to build features into the system to respond to those scenarios. For example, suppose an organization is planning to install a new closed-circuit video surveillance system. During the planning phase, members of the security team should walk through the facility, imagining how an intruder might try to sneak in. During this walkthrough, they should note where the cameras could be placed to catch this imaginary intruder.
The life cycle of security systems is similar to that of software, as shown in FIGURE 12-2. The security system life cycle includes five phases:
- Initiation
- Acquisition and development
- Implementation and testing
- Operations and maintenance
- Sunset or disposal
FIGURE 12-2 The security system life cycle.
The security system life cycle is simpler than the software development life cycle, but just as important.
Initiation
During the initiation phase, the existing architecture and security systems are documented, and a preliminary risk assessment is conducted. Applicable laws and regulations are identified. The documentation and analysis done during this phase are crucial to identifying what type of security system is needed and how it will work with existing systems.
Acquisition and Development
During the acquisition and development phase, a more complete risk assessment is completed, and a baseline security level is established. Once this is done, the security team establishes security goals and meets with vendors to choose specific solutions to meet those goals.
Implementation and Testing
Once a new system has been purchased, it must be installed. This occurs during the implementation and testing phase. Unit and integration tests ensure that the product performs as expected and works with existing systems. User training is a significant part of this phase.
Operations and Maintenance
This is the longest of the five phases. During this phase, the system is continuously monitored, incidents are dealt with, and the security team creates or modifies an existing business continuity plan.
Sunset or Disposal
Eventually, every security system becomes either unnecessary or obsolete and can no longer be upgraded. At that point, a new security system must be purchased and the old one removed. This happens during the sunset phase. The key to this phase is that the old system must be removed without exposing the organization to additional risk during the migration to a new system.
After a new security system has been installed, the old one must be disposed of securely because it could retain information that an attacker could use to gain entry into the organization’s facilities. Physical components must be disposed of or destroyed, electronic media wiped clean, and paper documentation shredded or securely archived.