5 hours 58 minutes
Welcome back to CyberRays. It's of course, I'm your instructor. Brad Roads. Let's jump into the fourth phase of the system development life cycle. That's operations and maintenance.
So, in this lesson, similar to all the other ones in this module, we're gonna look at security activities to talk about the linkages. And we're gonna define what operation slash maintenance is
so in security activities. What are we doing? This is where we're reviewing the system. If it's ready to go or not,
right? We're doing configuration management here. The configuration change process. That's what we're doing here. That's what that's we're talking about. We're instituting the processes and procedures. We're going to the point where we want to get to consistent execution with the system, right? If we have a very complex system with very complex security controls,
we as is he's a responsible for documenting all of that,
ensuring we've got the procedures laid out for everybody so that it z easy to follow it easy to implement, right? And then we monitor that right. We're gonna look at those security controls, be they technical, be they nontechnical, be they detective preventive. Whatever. Right. We are going to be monitoring those controls. We do that continuous monitoring here and throughout.
And then obviously we talked about the fact that we now deal with the risk management framework, the RMF, and that it's a continuous reauthorization process. And so it's very possible that with the rmf you could be reauthorizing a highly complex, highly sensitive system, you know, every six months or sooner, right? So it's very important to keep that in mind and
keep your poems prepped and ready to go.
So here's our linkages. We've decided again we talked about previously, and this is an important point to remember with the SCLC is that we can always stop. We can always say, You know what? I did my my needs to determine where I was gonna go make my requirements. Um,
I went ahead, designed thing put all together, and then I get to the point where I go toe operations maintenance, and I might say, You know what I'm done. I I don't need this system anymore. I need to move on, right. And so
one of the great things about these different pieces and parts of our of this SCLC is that each one of them is that decision point, uh, determine whether we're going to continue on with the system or stop doing what we're doing. And so three key things here. From a linkage perspective, it's operational readiness. It's
configuration management, change control
and then, importantly, continuous monitoring throughout the life cycle of the system. The decision point that we get to the end here of the operations and maintenance phase is gonna be planned well, before we got to this point. And that's the decision whether we're gonna dispose or decommission our systems.
So operations and maintenance maintenance is there two important things operations is the continuous monitoring side, and then maintenance have been patching and patching is a little, uh, it's probably a little less descriptive here than it should be patching, really? And what I'm implying here with patching is all the things that need to be done to keep the system up to date and patching could be
OS. It could be firm where it could be,
you know, software applications. It could be hardware stuff. Passion can be anything that allows us to keep our systems up to date and, oh, by the way, but keeping systems up to date, we're gonna frustrate the threat actors, because up to date systems are harder to break into the systems that are not on the continuous monitoring side.
That's again monitoring all of the controls throughout the life cycle
of our system while it's and operations, and that's looking at security controls that's looking at the functionality that's looking at everything. And it's looking at everything from, you know, the technical controls that we put in place, like, say, needs, hits all those kinds of things right to looking at the non technical controls to determine Hey, do we have the right
procedures written right? If we keep having a problem with, say, a data loss prevention engine
and it's because we didn't write the procedures right, Well, guess what? That's something that we can fix via that continuous monitoring process.
So in this lesson, we looked at the security activities in the operations and maintenance phase. We talked about the linkages as we've done previously, and then in operation and maintenance. We really looked at the fact this is con modern patching. This is keeping our systems up to date and then monitoring all of our security controls.
We'll see you next time
Certified Information Systems Security Professional (CISSP) 2021
CISSP is the basis of advanced information assurance knowledge for information security professionals. Often referred ...
16 CEU/CPE Hours Available
Certificate of Completion Offered
ISC2 CISSP Practice Test: Certified Information Systems Security Professional
There is a growing need for information security leaders who possess the depth of expertise ...