Development of Information Systems (SDLC and SecSDLC)

How is an Information System Developed?

Building a large Information System—like a university examination portal, a hospital management system, or a mobile banking app—cannot be done randomly. If programmers start writing code without planning or security checks, the system will fail or get hacked on Day 1!

Organizations build Information Systems using a step-by-step methodology called the System Development Life Cycle (SDLC), and in Cyber Security, we extend it into the Security Systems Development Life Cycle (SecSDLC).

💡 Real-Life Analogy:
When constructing a multi-storey building, you don’t lay bricks on the first day. You first survey the land, draw architectural blueprints, build a strong foundation, install fire exits and locks while building the walls, inspect everything, and finally move in. That step-by-step process is SDLC + SecSDLC!

1. The 6 Phases of Developing an Information System (SDLC)

Developing any Information System follows 6 systematic phases:

Phase 1: Investigation / Planning (Feasibility Study)

• What happens: Management defines why the new Information System is needed, what business problem it solves, and conducts a Feasibility Study:
  • Technical Feasibility: Do we have the hardware/software technology?
  • Economic Feasibility: Is the project within our budget (Cost vs. Benefit)?
  • Operational Feasibility: Will employees and customers actually use it?

Phase 2: Systems Analysis (Requirement Gathering)

• What happens: System analysts interview users, managers, and stakeholders to document what the system must do (Functional Requirements) and how fast/secure it must be (Non-Functional Requirements).
• Output: SRS (Software Requirements Specification) document.

Phase 3: Systems Design (Logical & Physical Design)

• What happens: Architects create the complete blueprint of the system:
  • Logical Design: Data Flow Diagrams (DFDs), ER Diagrams, database tables, user interface screens.
  • Physical Design: Choosing exact server hardware, cloud provider, operating system, and encryption algorithms.

Phase 4: Implementation (Coding & Testing)

• What happens: Programmers write the actual code (in Java, Python, C++, etc.), configure databases, and perform rigorous Testing (Unit Testing, Integration Testing, System Testing, and Security/Vulnerability Testing) to fix bugs before launch.

Phase 5: Deployment (Installation & Changeover)

• What happens: The tested system goes live for real users! Hardware is installed, old data is migrated to the new database, and employees are trained.

Phase 6: Maintenance and Post-Implementation Review

• What happens: The longest phase! Once the system is running, the IT team monitors performance, fixes new bugs, upgrades features, and installs regular security patches to defend against newly discovered cyber attacks.

2. SecSDLC (Security Systems Development Life Cycle)

Why Traditional SDLC Was Not Enough:

In the past, developers built the entire software first and tried to “bolt on” security (like adding a firewall or password screen) at the very end—just two days before launch. This left deep vulnerabilities (like SQL Injection and buffer overflows) inside the code!

SecSDLC (“Security by Design”) integrates cyber security activities into every single phase of the SDLC from Day 1:

💡 DAVV Exam Preparation Tips

5-Mark / 10-Mark Question: “Explain the process of Development of Information Systems. How is security integrated into the development lifecycle (SecSDLC)?”

• Draw the 6-phase SDLC flow diagram.
• Explain each of the 6 phases in 3–4 simple lines (Investigation, Analysis, Design, Implementation, Deployment, Maintenance).
• Include the SDLC vs. SecSDLC table to show how security is built into every step (“Security by Design”).