4.8. Information System Lifecycle
💡 First Principle: Security is not a feature bolted on at the end — it is a property that must be designed in at initiation, built during development, verified at deployment, maintained during operations, and preserved through disposal. Every lifecycle phase has security decisions that cannot be deferred without compounding cost and risk.
Why this matters: The CISSP tests lifecycle thinking: a question about "when should risk assessment first occur for a new system" expects "at project initiation" — not at testing, not at deployment. Organizations that defer security to the testing phase discover architectural flaws that require complete redesign. The cost to fix a security defect increases exponentially with each lifecycle phase it survives.
⚠️ Common Misconception: "Security testing at the end of development is sufficient." Testing can only find defects that exist — it cannot add security properties that were never designed in. An application built without input validation, without least-privilege database access, and without session management cannot be made secure by testing alone. Testing verifies that security requirements were implemented; it does not create them retroactively.
