Summary: NIST SP 800-64 Rev 2

Although there may be numerous methodologies available today for developing software whether it is based on a sequential, prototyping or even iterative model, the absence of security at each phase will render applications being vulnerable and easily exploitable when deployed. NIST 800-64 Rev. 2 provides a guide that incorporates security into a sequential model of a SDLC. Currently, at my organization this type of model is preferred since there are small development teams.

One of the first recommendations made by is NIST 800-64 Rev. 2 is based on policy and guidelines. It states that there should be a written SDLC policy tailored to suit whether the business develops its own software or outsources software development and even maintenance. At my organization, there is a mesh of both. Large complex enterprise systems are usually outsourced while smaller manageable applications are developed in-house where there may not be an alternative available at a low cost. For example, human resources and student information management systems are purchased from large corporations like Oracle.

At the initiation phase, the business requirements in relation to maintaining the CIA triad, privacy and even business regulation requirements are outlined. In addition, it includes security planning, categorizing the information system, assessing the business and privacy impact and ensuring secure development processes. Next, in the development phase tasks include assessing risk, selecting security controls, designing the security architecture, developing security documentation and conducting testing. The third step, is the implementation phase, where the integration of security into production environment is done, system assessment and authorization is executed. At the operations and maintenance phase, security team must ensure the operational readiness is reviewed, configuration management and continuous monitoring.  When the information system is no longer in use, the disposal phase is executed which includes: following a transition plan, preserving information, sanitizing media, disposing of hardware and closing off the system.