The NIST 800-64 rev2, Security Considerations in the System

The NIST 800-64 rev2,
Security Considerations in
the System Development
Life Cycle

1. Overview of
The NIST 800-64
rev2An basic idea of NIST 800-64 rev2

Basic overview
The National Institute of Standards and
Technology (NIST) Special Publication (SP) 800-
64, Security Considerations in the System
Development Life Cycle, is developed so that
it is possible to assist federal government
agencies as it is often complex to integrate
essential information technology (IT) security
steps with the established IT system
development life cycle (SDLC)
3

Meaning of SDLC
System development life cycle (SDLC) is an
integral part of development of any IT system.
it basically consists of various cycles that are
required to complete the development process
of any proposed IT system. basically it consists
of system planning, execution, system
development and system maintenance.
4

Importance of scurity
in SDLC
▰ provides security to system and information it
process
▰ Provides enhanced system maintenance and also
reduce cost for system management
▰ increase organizational value through effective
and secure data management
5

Phases of SDLC
security integration
There are total six phases involved in securing SDLC and those
are:
▰ Investigation
▰ Analysis
▰ Logical design
▰ Physical design
▰ Implementation
▰ Maintenance and change
6

SDLC security integration
phases
Investigation
▰ Process, outcome and
goal identification
▰ problems analysis
▰ Project scope
identification
▰ constraints
identifucation with
Analysis
▰ review of existing
security policies
▰ Review of legal issues
▰ execution of risk
analysis
logical design
▰ Development of
security blueprint
▰ planning for incident
response
▰ Planning for business
response for disaster
▰ Feasibility review of
outsourcing project7

SDLC security integration
phases
Physical design
▰ Technology selection to
support security blue
print
▰ Physical security
measure design
▰ Project review and
approval
Implementation
▰ purchase or
development of
security solutions
▰ presentation of tested
package for
management approval
Maintenance and
change
▰ monitoring, testing,
modifying and update
in constant basis for
meeting threats due to
the change process
8

Thank you
9