Embedding security practices in contemporary information systems development approaches

As information and communicatio n technologies become a critical component of firms’ infrastructure s and information establishe s itself as a key business resource as well asdriver,peoplestart torealisethat there is more than the functionalit y of the new information systemsthat is significant. Business or organisational transactions over new media require stability , one factor of which is information security. Information systems development practices have changed in line with the evolution of technology offerings as well as the nature of systems developed. Nevertheless , as this paper establishes , most contemporary development practices do not accommodate sufficientl y security concerns. Beyond the literature evidence, reports on empirical study results indicating that practitioners deal with security issuesbyapplyingconventional risk analysis practices after the system is developed. Addresses the lack of a defined discipline for security concerns integration in systems development by using field study results recording development practicesthatarecurrently inuseto illustratetheir deficiencies ,to point to required enhancements of practice and to propose a list of desired features that contemporary development practices should incorporate to address security concerns. This work has been supported in part by the Ministry of Development, Hellenic Secretariat for Research and Development, through programme YPER97. standards such as the Capability Maturity Model (CMM), could strengthen the initiatives of organisations for IS assurance and security. Quality certification is not directly linked to security aspects, but there are strong relating requirements for: duty separation, job descriptions and document control; and validity and availability of documentation and forms. Fillery and Chantler (1994) view this as a problematic situation and argue that lack of quality procedures and assurance in IT production is the heart of the problem and dealing with this issue is essential for embedding worthy security features in them. Information security problems in contemporary product/component-oriented development practices could be resolved in the context of quality assurance, since each single product could be validated and assured properly. The validation of products along with process assurance is the heart of the holistic proposal from Eloff and Von Solms (2000), which exploits this trend and combines both system components and system processes. The previous proposals address the importance of information security in the modern world and the need to be integrated in systems development, but still, they do not refer explicitly to the changes that need to be introduced in development practices, actors and scenarios. Furthermore, assurance of high-quality development cannot by itself ensure security, as even the perfect product could be subject of misuse. Thus, this paper sets off to address the following questions: 1 What do practitioners and developers do when they face requirements for secure systems development, how do they integrate security concerns to their development processes? And in particular: Do they, and if so how do they, implement security solutions early in the development processes? How do the implemented solutions get integrated to the overall organisational structure and everyday life of a particular organisational environment? 2 What perceptions of security do the involved IS stakeholders have? What implications do those perceptions have in the development of secure systems? Information security is a field combining technical aspects as well as social, cultural and legal/regulatory concerns. Most of the attempts to resolve security problems are focused largely upon the technological component, ignoring important contextual `̀ soft’’ parameters, enlarging in this way the gap between real world’s requirements for secure systems and the means to achieve it. Development approaches In the past the information systems’ boundaries within the organisation were quite clear and limited. As business process support tools their essence and structure were stable, confined first to automation of basic transaction processing, to explode then in a multiplicity of forms of management support tools. The basic tenets of systems development theory and practice were that systems could be produced in a specific and (in theory) standardised way, proceeding linearly through well defined stages, including a substantial programming effort, intersected by inspection and feedback milestones. The systems engineering paradigm is encapsulated in most methodologies available (Avison and Fitzgerald, 1993). Nevertheless, the `̀ profile’’ of systems development approaches has undergone fundamental changes along with the evolution of technology, as well as the nature of systems found in today’s enterprises. In essence, the traditional approach, based on the life cycle concept for a systems project, cannot capture the extensive use of commercially available application platforms as a basis for new systems development. Moreover, the vast variety of commercially available software products that can be combined to reach the required functionality for a particular system makes component-based development a realistic option. In all, systems development `̀ from scratch’’ is far less practiced compared to ten years ago. The information systems literature, in which the methodologies movement flourished in the 1980s and early 1990s, has not addressed sufficiently the new norms of practice. In this paper, we introduce a rudimentary classification of contemporary systems development practices along the well-known `̀ make or buy’’ divide. Most systems projects are now anchored on the `̀ buy’’ maxim; there we introduce two development approaches, namely single product based and componentbased development. On the `̀ make’’ side we have proprietary development. We argue that each of these three approaches introduces different challenges to developers regarding security concerns. When the IS department could not allocate the requested human resources, or its [ 184] T. Tryfonas, E. Kiountouzis and A. Poulymenakou Embedding security practices in contemporary information systems development approaches Information Management & Computer Security 9/4 [2001] 183±197 resources did not qualify in terms of experience and know-how for a specific development project, a ready-made system could have been purchased. At such times a system could be considered an accounting package and the computer in which this resided. Therefore the scope of a ready-made solution could vary from a single package to a comprehensive IS. In the case that more than one application was chosen and eventually operating, it was practically very difficult to integrate them so as to produce a unified and comprehensive organisational information management solution. The composition of the technical infrastructure was made from ready packages in whose operational philosophy should the organisation fit-in. This is a major contradiction to in-house development of a solution, which leads to systems tailored to a particular organisation’s needs and character. But contemporary development practices managed to soft-pedal this contradiction. Single-product based (or configuration) development The evolution of the technological infrastructure, the knowledge that evolved about systems development and results from the successful, or not, application of a number of ready-made systems, led to the creation and institution of basic parts of technology solutions (core systems), that, deployed with a proper configuration, could fit-in to any organisational environment (Fitzgerald, 1998). This practice, termed as single-product based development or configuration development, has led to the development of information technologies that implement a core functionality of an organisation and are customisable (can be properly configured) depending on the environment. Examples of such systems are the enterprise resource planning (ERP) systems such as the SAP, BAAN and PeopleSoft product suites. Single-product systems enable the standardisation of business processes and also facilitate the difficult task of communication of horizontal applications within a vertical sector (Vasarhelyi and Kogan, 1999). Component-based development Market requirements for successful and on-time delivered systems that can face the rapid changing contemporary business and social reality led to a second popular practice of developing systems, the component-based development. Development efforts are allocated to relatively independent sectors/ sub-systems of a manageable size that could possibly be implemented by different and topologically distributed teams. Monolithic systems are abandoned as they fail to meet the needs of modern business processes and to be delivered on time. By following this practice, one can schedule earlier the delivery of the critical system’s components and in general, all components can be arranged and scheduled to be delivered in terms of their priority (Clements, 1995). In addition, basic user requirements can be met from the beginning of the development effort, so that an organisation could take advantage of the system before this is fully implemented and deployed. This principle empowers rapid application development (RAD) practices that substitute monolithic application development with modularised, componentbased systems, the components of which have been properly evaluated by the system’s endusers and domain experts. There is a general impression that the conventional linear lifecycle of monolithic systems cannot contribute anymore to the development of successful systems and their on-time delivery (Howard et al., 1999). Proprietary development Organisations’ informational needs were defined in the past by the relatively small requirements for automation of their processes. The main objective was compute