Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

1. Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition Chapter 5 Technical Processes

2. Objectives • Understand the role and purpose of the technical processes in ICT work • Understand how stakeholder needs are translated into a working solution • Understand how the integrity of an ICT system, product, or service is sustained throughout its useful lifecycle • Understand how the proper evolution of technical solutions is ensured through rational processes Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

3. Overview of the Technical Process Group • Activities in the ISO 12207-2008 technical process group provide the template for the development and sustainment of an ICT product • They are part of the traditional development, operations, or maintenance lifecycle • All three lifecycle processes must work together to ensure the integrity of an ICT product • Processes in this group represent the activities carried out by a typical ICT shop • Design, coding, integration, testing, installation, etc… Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

4. Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

5. Overview of the Technical Process Group • First eight processes are part of conventional development including: • Requirements collection, design, implementation, testing, and acceptance • The rest of the activities are considered part of the sustainment process • Activities in the last three areas usually occur over a longer period of time • During which the product is securely operated, maintained, and eventually disposed of Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

6. Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

7. Development Processes of the Technical Process Group • The first eight processes are the tasks associated with the traditional waterfall lifecycle development model • The waterfall model is the most common lifecycle development model • The first step in the model defines product requirements • Called stakeholder requirements definition • Requirements: the actions that a system is required to perform Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

8. Stakeholder Requirements Definition • Stakeholder requirements definition describes the function that users and other stakeholders want the product to perform • And how system will interact with its operating environment • Must be accompanied by descriptions of all stakeholders who will use the product • Context and stakeholder input are important to the overall success of the technical process • They help software developers understand how a specific function will be carried out Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

9. Stakeholder Identification • First step in developing an ICT product is to identify the stakeholder community • People who will use the product • The list of stakeholder needs can be formulated into formal stakeholder requirements • Provide the point of reference that guides the product development process throughout its lifecycle • Contractual requirements: specific terms and conditions of a legally binding agreement • Description of product requirements, assumptions, and constraints serves as a foundation for product Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

10. Stakeholder Requirements Identification • Next step in the process is to elicit stakeholder requirements • Typically captured in a formal document called a requirements specification • Includes a complete listing of the functions required of the product as well as a full description of the product’s environmental constraints • Environmental constraints itemize the influences on the product’s construction • Constraints are dictated by the capabilities and operating characteristics of the customer Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

11. Stakeholder Requirements Identification • Users’ capabilities and skill limitations must be considered when the ICT product team develops overall product constraints • Health, safety, and security concerns are major areas of focus for product definition • Threats to intellectual property and environmental influences are also concerns • Security functions: specific requirements aimed at ensuring the security of a product • Usability requirements might also have to be identified, specified, and implemented Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

12. Stakeholder Requirements Evaluation • The next step is the specification and evaluation of product requirements • Product requirements need to describe: • The functions and capabilities of the system • Business, organizational, and user requirements • Safety, security, human factors engineering, interface, operations, and maintenance requirements • Design constraints • Qualification requirements Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

13. Stakeholder Requirements Agreement and Recording • The final part of the process is to obtain consensus and formally document the requirements • By having stakeholders review the results of the requirements evaluation and sign-off on it • Once consensus is reached: • Stakeholder requirements are formally accepted and entered into the requirements management process • The finalized requirements specification establishes the baseline functions required for the product Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

14. System Requirements Analysis • System requirements analysis: to transform the stakeholder requirements into a set of technical specifications to guide system design • The result is the formal specification of product requirements • Basis of the request for proposals (RFP) • Functional requirements: an explicit statement of the actions a product must perform • Must be described in requirements specification • Nonfunctional requirements: qualitative features of a system, such as security Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

15. System Requirements Analysis • In the areas of safety and security, the specification must consider “methods of operation and maintenance, environmental influences, and potentials for personnel injury relating to each software item” • Specification of requirements: a formal document that communicates customer needs • Should consider all aspects of anticipated operation, maintenance, and execution • The developer must conduct a joint review in accordance with the software review process (7.2.6) Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

16. System Requirements Analysis • The outcome of ICT product requirements analysis: • Set of product function descriptions that state the problem to be solved and specific methods that implement the preferred solution • Requirements are analyzed for correctness and testability • Product team establishes consistency and traceability between documented requirements and customer’s original requirements • Finalized requirements are given to all affected parties and “baselined” under configuration management control Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

17. Requirements Specification • Requirements specification formally describes the product’s functions and capabilities • As well as its qualitative requirements (safety, security, human factors, interface, operations, and maintenance) • All relevant design constraints and qualification requirements are formalized • At the end of the process, requirements are prioritized, approved, baselined, and communicated to all affected parties Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

18. Requirements Evaluation • Goal is to produce the best possible set of requirements • Requirements are evaluated to see if they meet customer’s needs • Formal inspections and reviews have to be undertaken with the appropriate set of stakeholders to confirm the requirements satisfy the functions of the proposed product • Requirements are the source document for eventually confirming the product as built Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

19. The Architectural Design Process • Architectural design determines how each requirement identified in the specification stage is built • Establishes an architecture for the product • The goal of this step is to incorporate requirements into a logical design that guides construction • Developer should begin to create preliminary versions of documentation and test requirements • Once the architecture has been validated as correct, it is baselined under configuration management control Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

20. Establishing Architecture • First step in architectural design establishes a top-level architecture by identifying all issues relevant to hardware, software, and manual operation • For each module, specifications for necessary hardware configuration, software configuration, and manual operations are: • Identified, allocated, and documented along with the internal and external interfaces of each element Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

21. Architectural Evaluation • The architecture and its requirements are evaluated to determine whether they are traceable and consistent with formal requirements • The methods and techniques used to develop the design are analyzed • To determine whether they are feasible • The design is also assessed • To determine whether it meets the requirements and whether the resulting modules can be operated and maintained Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

22. The Implementation Process • In this phase, the developer produces the technical design for each component itemized in the architectural design • Ensures all requirements are directly traceable to a component being built at this stage • The developer creates and documents a design for all external and internal interfaces • Interfaces: specific points where modules are joined together in a system • The developer also produces a technical design for the database and updates user documentation Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

23. The Implementation Process • Once the design is confirmed as correct • It is turned over to those who perform the actual construction • The developer builds the components or writes the code for each required component and creates documentation for each item • The standard requires all elements to be evaluated based on the criteria of traceability, external and internal consistency, appropriateness of the methodology, and feasibility Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

24. The Integration Process The purpose of the integration phase is to combine all appropriate software, hardware, manual operations, and other systems into a complete system The developer needs to devise an integration plan to ensure proper integration of all developed components into a single piece of software Plan ensures each entity satisfies stakeholder requirements and that each component entity is properly integrated Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

25. Integration • The software in the product is integrated with the hardware at this stage • The end product of this process is the desired system • Products are tested against the requirements as they are developed • The integration strategy should address all consistency and traceability issues between the design and the integrated components Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

26. Test Readiness The standard requires a documented set of test results for each qualification requirement For each qualification requirement, the developer prepares and documents a set of tests, test cases, and test procedures for conducting qualification testing of the product The integrated system is evaluated for test readiness based on the degree of test coverage, appropriateness of test methods, conformance to expected results, feasibility of system qualification testing, preparation, and maintenance Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

27. The Qualification Testing Process • The purpose of systems qualification testing is to ensure implementation of each requirement is certified as compliant and ready for delivery • The developer must evaluate the design, code, tests, test results, and user documentation • Using traceability, external and internal consistency, appropriateness of methodology, and feasibility • A set of criteria is developed for evaluating compliance with system requirements • The integrated system is testing using that criteria Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

28. Qualification Testing • If the end product is a system rather than software: • The finished system must undergo qualification testing based on a set of qualification requirements • Each system component is evaluated to assess compliance with original requirements • To see if it is ready for delivery • The developer has to establish a formal release baseline • If all system elements pass their audits, the developer can begin the installation stage Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

29. The Installation Process The next stage is to install the product in the target environment according to the specifications of the initial requirements document A software installation strategy and installation criteria are developed in compliance with the requirements of the contract The developer installs the product in accordance with the installation plan Installation plan: a road map of the actions and timing involved in placing a product in a user’s environment Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

30. Software Installation The installation requirements should include specifications for the product environment The resources and information needed to install should be determined in advance and must be available The implementing organization should assist with all setup activities specified in the contract The installer should document the installation events and results Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

31. The Acceptance Support Process • The final step in the development process is acceptance of the product by the acquiring organization • An acceptance review and testing procedure must incorporate and account for any information acquired during: • Joint reviews, audits, software qualification testing, and system qualification testing • Problems detected during acceptance must be identified, documented, and communicated to parties responsible for their resolution Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

32. Product Acceptance Support The developer must support all acceptance reviews and testing carried out by the acquiring organization Outcomes of qualification testing are often incorporated into the final documentation After acceptance, the product is delivered by the developer The developer normally provides training and support to the acquiring organization as specified in the contract Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

33. Technical Process Group: The ICT Operations Process • The purpose of the software operation process: • To maintain the software’s required level of performance during its lifecycle • The operations team must define a strategy and criteria for evaluating performance • To ensure it is achieving it’s purpose • The operations process begins with a plan • Also includes a requirement to specify standards to guide the work • The operations process is characterized by the ongoing execution of the system’s operating steps Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

34. Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

35. Preparation for Operation • The operations process starts with planning • The plan is documented and executed as a day-to-day practice • The operator needs to establish procedures for receiving, recording, resolving, and tracking problems • Also for providing feedback • The plan must include procedures for testing the product in its operating environment • Has to include a means for entering problem reports into the software maintenance process Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

36. Operation Activation and Check-Out • The operator is responsible for performing routine procedural testing for each release • To approve the release of a product: • The operator must confirm that all operations conform to the specifications of the development or modification plan • Once approved for release: • There must be a formal scheme to recognize that a product has been delivered to an organization for use Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

37. Operational Use This function requires sustaining assurance that the system is being operated in the intended manner and according to plan The operational monitoring and reporting responsibility must be connected to quality assurance The operation activity must include an explicit enforcement mechanism to ensure all standards are being followed The operator must develop criteria to demonstrate compliance with requirements Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

38. Customer Support • The operations function requires the organization provide advice and support to end users • A formal process to forward user requests to the software maintenance process must be established • Those requests must be analyzed and addressed • Actions planned must be reported to the users • The operator provides assistance and consultation to users in the form of training, documentation, and other services that support effective use of the product Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

39. Problem Resolution One of an operator’s most important roles is to forward an identified software problem to the problem resolution process Permanent corrections, releases that include previously omitted functions or features, and system improvements are applied to the product using the software maintenance process Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

40. Technical Process Group: The ICT Maintenance Process • The software maintenance process makes modifications to the product and provides support • Such as training or operating a help desk • Maintenance clause of the standard defines the activities and tasks typically undertaken by any organization that proposes to perform maintenance • Goal of maintenance: to change an existing ICT product while preserving its integrity • The maintenance process uses testing to demonstrate that system requirements are not compromised Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

41. Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

42. Process Implementation • The aim of the plan is to establish a standard, approved processes for systematically reporting, documenting, and tracking user-generated problems or requests for change • The maintainer establishes for receiving, recording, and tracking problem reports and modification requests from users • And for providing feedback to stakeholders Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

43. Problem and Modification Analysis The maintainer must analyze the problem report or modification request for its impact on the organization Criticality assesses the impact of the requested change on performance, safety, or security A report describing the request, resulting analysis, and the various implementation options is presented to an authorizing agent The person who coordinates the change request is often called a change manager Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

44. Implementing Modifications • The maintainer conducts an analysis to determine which documentation, software units, and versions are part of the requested change • Once analysis is complete, the maintainer documents it and uses appropriate technical processes to make the changes • Then implements the modification as specified • New and modified requirements must be ensured for completeness and correctness Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

45. Maintenance Review and Acceptance • The maintainer conducts reviews with the authorizing organization to determine that the integrity of the modified system has been preserved • Once the change has been verified as correct: • The organization must determine how it will be integrated back into the system • When the integration plan as been approved, a final sign-off is required to close the loop on the SOW Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

46. Migration • The standard provides guidance to ensure that any system, product, or service is migrated based on a formal and documented plan • Migration is resource intensive and a formal business activity • Justification is to enhance or repair a system, product, or service operation • To support the evaluation for a migration, a plan must be developed, documented, and executed • Should include every relevant stakeholder, especially users Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

47. Migration • The migration plan should include a requirements analysis, a definition of the migration, and a list of migration tools that will be used • Users must be kept informed of all plans and activities • Necessary training must be provided as specified in contract • A formal review after a migration should be performed • To determine how well the organization is adapting to the new system Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

48. Technical Process Group: Disposal • The purpose of the disposal process is to end the useful lifecycle • It typically deactivates, disassembles, and removes the affected system, product, or service • Consigning it to a final state of decommission and leaving the environment in an acceptable state • The process destroys or stores components in a proper manner in accordance with legislation, agreements, and organization’s requirements • Can be retired only at the request of the owner Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

49. Disposal Planning • The first step in planning is to define and document a disposal strategy • The disposal plan defines schedules, actions, and resources that: • Terminate the delivery of services • Transform or retain the system in a socially and physically acceptable state • Account for the health safety, security, and privacy issues applicable to disposal • Goal is to ensure a smooth transition from the retiring system Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition

50. Disposal Execution • Users must be notified of the plan and all related activities for retiring the affected product • Notifications should include: • A description of any replacement or upgrade to the product • Its date of availability • A statement that explains why the old product will no longer be supported • All relevant data associated with the retired product should be made accessible in accordance with any contract requirements for auditing Cybersecurity: Engineering a Secure Information Technology Organization, 1st Edition