Trend Report of IST 309

Projects

Tony Coulson Ph.D.

Portions adapted with permission from Whitman & Matford, Principles of Information Security, 3rd Edition, Course Technology 2009

• We identify goals and objectives • We gather resources and more details • We develop and test • We maintain

How do we execute projects?

333333

How do you get from here..... To here?

343434

Systems?

Electrical

Structural

Water

Drainage

Finish

§ Often initiated by upper management

§ Issue policy, procedures, and processes

§ Dictate goals and expected outcomes of project

§ Determine accountability for each required action

§ The most successful also involve formal development strategy- the most commonly understood is the systems development life cycle

Projects

§ Using a methodology:

§ Ensures a rigorous process

§ Avoids missing steps

§ Our goal is creating a comprehensive security posture/program, one that can pass audit!!

Why a Formal Methodology?

SDLC

§ What problem is the system being developed to solve?

§ Objectives, constraints, and scope of project are specified

§ Preliminary cost-benefit analysis is developed

§ At the end, feasibility analysis is performed to assess economic, technical, and behavioral feasibilities of the process

Investigations

§ Consists of assessments of the organization, status of current systems, and capability to support proposed systems

§ Analysts determine what new system is expected to do and how it will interact with existing systems

§ Ends with documentation of findings and update of feasibility analysis

Analysis

§ Main factor is business need; applications capable of providing needed services are selected

§ Data support and structures capable of providing the needed inputs are identified

§ Technologies to implement physical solution are determined

§ Feasibility analysis performed at the end

Logical Designs

§ Technologies to support the alternatives identified and evaluated in the logical design are selected

§ Components evaluated on make-or-buy decision

§ Feasibility analysis performed; entire solution presented to end-user representatives for approval

Physical Design

§ Needed software created; components ordered, received, assembled, and tested

§ Users trained and documentation created

§ Feasibility analysis prepared; users presented with system for performance review and acceptance test

Implementation

§ Consists of tasks necessary to support and modify system for remainder of its useful life

§ Life cycle continues until the process begins again from the investigation phase

§ When current system can no longer support the organization’s mission, a new project is implemented

Maintenance