-: In this section of the course,
we're going to talk about software development.
When a piece of software is created,
it requires a lot of work.
Each and every function that's performed by that software
has to be written to be able to do its intended role.
This often requires the work of dozens of programmers
and hundreds of thousands of lines of code.
Often, when a bug is found in a piece of software,
I hear people ask why that company didn't figure it out
before the software was released.
Well, there's lots of different ways
to conduct software testing,
and we're going to talk about them later on in this section.
But bugs are still going to find their way into code
because our software is so complex these days.
Let's take for example the Windows 10 operating system.
It consists of over 50 million lines of code
and took the involvement of hundreds
of different programmers.
With that much complexity, there's always a chance
that an error is going to be introduced into the code base.
Now, to try and counteract the complexity
of our software development,
many models and methods have been introduced,
the most common of which is known
as the software development life cycle or SLDC.
The software development life cycle is an organized process
of developing a secure software application
throughout its life cycle throughout the project.
This process covers everything
from the initial idea of the software,
through its coding and testing,
and even into its deployment and retirement.
The software development life cycle
is based on a generic Waterfall model of development.
Each phase of a life cycle
is broken down into smaller portions.
As each one is finished, the next one has begun.
The reason this model is termed the Waterfall
is that information and the software product itself
flows from the top stage all the way down
to the bottom stage, getting more developed
as it progresses downward.
Visually, this looks like a waterfall,
as shown in this example on the screen.
Different organizations use different phases or stages
as part of their software development life cycle though,
but for the CompTIA Security+ exam,
you need to know the seven phases as CompTIA defines them.
Now, let's cover each of these seven phases.
The first phase is planning and analysis.
During this stage, the goals of the software project
are determined, the stakeholder needs are assessed,
and all of the high-level planning work is conducted.
Essentially, this is where things go
from a rough idea that someone had for a piece of software
into a bit more formalized and well-developed concept
that we can plan the rest of our development cycle against.
Once all the requirements have been gathered,
we can move into the phase
that's known as software or systems design.
It's during this stage that the application
or system is defined, outlined, and diagrammed in detail.
Essentially, this is where we focus
on the overarching inputs and outputs of each function
that are going to make up the final software
that's going to be released to our customer.
At this point, we still haven't created
any programming code though.
This brings us to the third phase,
which is called implementation.
During implementation, programmers will begin to code
all of the various functions
that are needed for the final product.
As each piece of the code is developed,
the programmers will conduct
some basic debugging and testing
to ensure that its functionality is working properly.
But, at this point,
there's been no formal testing completed yet.
The fourth phase is reserved
for that formalized testing of the application.
It's during this phase that we get the code
and we check it through a myriad
of different testing methodologies.
We're going to spend an entire lesson
on those testing methodologies later on in this section.
Once the testing is complete,
the integration phase will begin.
During this phase, the application or system
is integrated into the larger network environment.
Whereas in phase four,
we focused on testing the individual application or system,
in phase five, the integration phase,
we're focused on testing the end-to-end service
to ensure that all of the pieces and all of the parts
can communicate effectively and correctly.
For example, if you finish developing
a new software application to provide quiz questions
to your students through the website,
now you have to make sure
that you integrate that quiz application
into the web server, the databases that hold the questions,
the network connectivity, and everything else
that connects your server to the outside world.
Connecting these different applications
and systems together is known as integration.
The sixth phase is known as deployment.
During deployment, your application or system
will be moved into the production environment
where your customers and your end users
can now utilize it to perform their work.
In the example of Windows 10,
deployment occurred when it was installed on a new PC
or it was downloaded from Microsoft's website
to upgrade your current Windows 8.1 workstation.
This is the phase that allows real work to be done
using your new software applications.
The seventh and final phase is called maintenance.
As I stated at the beginning of this lecture,
software bugs and vulnerabilities do happen.
This means that once your product
is released into deployment,
your work is still not finished.
Instead, the programmers are now focused on bug fixes,
patches, and updates to the version of the software
that you're going to end up using.
Additionally, your organizational service desk
is now focused on helping your end users
to understand how to properly use this program
more efficiently and effectively.
This is another piece of the larger ongoing maintenance
that an organization will do
as part of its software development life cycle.
When we discuss maintenance of the software,
two very important concepts are version control
and configuration management.
This will ensure that as you update
or fix a problem in your baseline software,
you have a way to identify what is the newest version
and what is the older version.
Often, this is done using a numbering scheme
that consists of major, minor, and build version numbers.
For example, if you're running Windows 10.0.12425,
that shows up as a major version 10,
a minor version 0, and a build number of 12425.
Eventually, this software will become outdated and old
and it will have to be retired.
Under the CompTIA model, this is also considered
part of that seventh phase called maintenance.
In other SDLC models through,
retirement is often considered its own phase.
For example, Windows XP is considered
a piece of unsupported or retired software
because it's no longer supported by Microsoft.
Therefore, if your organization is running Windows XP still,
you need to develop a retirement plan
to migrate your current business functions and processes
off of those Windows XP workstations
and into a more modern and supported version of Windows,
like Windows 10.
Now, the Waterfall model works great for projects
that are very complex, and they also are great
for things that need high levels of security.
This is accomplished
through that testing that we talked about.
But this does take up a lot of time
and it doesn't support rapid development or rapid changes.
For example, under a Waterfall development,
it can take six to 12 months
to get from the first planning phase
all the way through to deployment
and maintenance in the seventh phase.
Any changes in your requirements
would require us to go back to an earlier stage
and continue down that Waterfall again.
In a strict Waterfall scenario,
you wouldn't even be able to add additional features
until the initial product was already delivered.
This means you're going to have to wait for the next version
to release those and get those changes out
to your end users.
In response to this, a different way of software development
has risen in popularity.
This is known as Agile development.
Agile software development is performed
in time-boxed or small increments
to allow it to be more adaptive to changing requirements.
In Agile, we still perform most of the phases
that make up the Waterfall model,
but the big difference is we do them much, much quicker.
For example, many Agile development projects
work in either a two-week or a four-week time period
known as a sprint.
The goal in Agile is to release smaller product portions
more quickly and more often,
and at the end of every sprint,
something has to be released.
In a Waterfall model, for example,
we might be trying to release an entire operating system
like Windows 10, but in Agile, we would release
just three or four features in this two-week period,
and then, we'd add another few features
for the next two-week period,
and we'll continually add small pieces
until we provide the additional functionality we want
all along the way for this final product.
For the Security+ exam,
you don't need to know Agile in depth.
If you really want to dig into Agile project management
and development though, I would recommend watching
our course on PRINCE2 Agile Foundation,
which is an excellent certification for Agile development.
This will give you a great primer
on using many different types of Agile development methods
when doing software or other highly adaptable projects.
The final term that I wanted to cover in this lesson
is known as DevOps.
DevOps is a term created from the words development
and operations.
This is a way of conducting business
where the software developers
an the IT operations personnel
work closely together to speed up the development
and deployment of the applications
and to get things out to the end user quicker.
Because of the reduced timeline,
it's a good idea to embed a security-minded person
into the DevOps team as well
to ensure that good cybersecurity is not sacrificed
in an effort to get the product out quicker.