Now, once software has been formally accepted by the customer or client, it is ready to be installed or released. But the installation and deployment process itself needs to proceed and be performed with security firmly in mind. It does not necessarily mean that it will be deployed with security controls in place. Now, all of the software assurance efforts in designing and building the software can be rendered futile if the deployment process does not take into account security. In fact, it has been observed that software faces hiccups when it is installed. A decision such as following the software to run with elevated privileges or turning off the monitoring and auditing functionality, oftentimes, adversely affects the overall performance and security of the software.

Once the software is deployed, it needs to be monitored to guarantee that the software will continue to function in a reliable, resilient, and, importantly, recoverable manner. Ongoing operations and maintenance, including addressing of the incidents impacting the software and patching the software to mitigate its chances of being exploited by hackers and malware threats. Finally, there is a need to identify the software and conditions under which the software needs to be disposed of or replaced because insecure and improper disposal procedures can and often have had serious security implications.

We're gonna cover the security aspects that a CSSLP needs to bear in mind when dealing with the final stages of the software development life cycle, comprising deployment, operations, maintenance, and, ultimately, the disposal of the software. Understanding the importance of this process, being familiar with secure startup or bootstrapping concepts, knowing how to harden the software and the hardware to assure trusted computing as the result, being familiar with the configuration management concepts and how they impact the security of the software, understanding the importance of continuous monitoring, understanding the need to determine the root cause of problems that arise in software as part of problem management, and knowing how patching can affect the state of software security.