CISSP 20.1 - Introducing Systems Development Controls (Part 3 of 5)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series carries the Domain 8 build forward from writing code through testing, maintenance, and the major life cycle models. It walks the middle and later stretches of development so security can ride along at every stage rather than getting left behind when features rush to launch.

Frequently Asked Questions

What happens once coding begins, and how is it reviewed?

Once stakeholders bless the design, developers start writing code that matches the agreed plan and applies secure coding principles. Because fresh code always hides mistakes, project managers schedule code review walk-throughs at coding milestones. In these technical sessions, developers sit with a specific module and step through it line by line, hunting for logic errors and security flaws. Usually only development staff attend, and the goal is to confirm each team’s code behaves as specified.

How do you test a system before it goes live?

Testing starts inside the team, then widens as developers and real users run the system against scripted scenarios covering ordinary and unusual activity. When updating an existing system, regression testing confirms the new code behaves like the old except for intended changes. Cover both functional testing, which proves the software works, and security testing, which proves no serious weaknesses slipped through, before users perform acceptance testing to agree it is ready for production.

Why does change management never really end?

Because the moment a system goes live, its maintenance begins and never stops. Operational needs, data volumes, storage, and the surrounding environment all keep shifting, so you need a skilled support team ready for routine and surprise upkeep. Every change to the code must flow through a formal change management process rather than happening ad hoc, so nothing slips in unreviewed, much as a bridge carries traffic for decades only because crews inspect it on schedule.

How do the waterfall and spiral models differ?

Waterfall views development as sequential stages, each completed before the next, with iterative and modified versions adding feedback loops and verification and validation, though it lets you step back only one phase. The spiral model wraps several waterfall passes into repeated loops, a model of models, where each loop produces a new prototype and you can return to planning whenever changing technology or customer needs demand it, resolving risks each time around.

What makes agile different, and how does Scrum apply it?

Agile grew from a reaction against rigid, heavyweight models, valuing individuals and interactions, working software, customer collaboration, and responding to change. It is a philosophy rather than a single method, and Scrum is the most popular practice. Scrum runs on short daily meetings guided by a scrum master, with work happening in sprints of usually one to four weeks, each ending in a functioning, releasable product that grows richer sprint by sprint.

Reference: This article is based on concepts discussed in CISSP 20.1 - Introducing Systems Development Controls (Part 3 of 5).