Life cycle models

“Start small. Don’t try to boil the ocean. Start with a small, manageable size and ‘follow the bit.' By this, I mean follow data from creation, through usage, to transmission, to storage, and ultimately to end of life. A good security architecture should be fluid; it needs to be a living document. If you try to make all decisions at once, they will tend to compete. Narrowing the focus is step one. Understanding the full life cycle is step two.”

– Steve Orrin, Federal CTO at Intel Corporation

Typically, the development model in use ties to the security architecture for a given application at a fundamental level. There are a few reasons for this. The first is that the way software is developed will likely influence the security of the result. We stressed this previously: if you follow a disorganized, slipshod development process, you’ll increase the likelihood of producing a disorganized, slipshod result. As a result...