Which of the following characteristics ensures the security of an automated information system is the most effective and economical?

The principle of "security by design" dictates that security should be an integral part of the system development life cycle (SDLC) from the very beginning, rather than an afterthought. Integrating security controls and considerations during the initial design and architecture phase is demonstrably the most effective and economical approach. Addressing security flaws late in the development cycle or after deployment is significantly more expensive and complex, often requiring substantial redesign and re-engineering efforts. A system originally designed for security is inherently more robust and less costly to maintain over its lifetime.

B. Subjected to intense security testing: Testing is a crucial verification activity, but it finds flaws after they have already been built. It is more economical to prevent flaws during design than to find and fix them later.
C. Customized to meet specific security threats: While threat modeling and customization are vital, they are most effective when applied to a system with a fundamentally secure architecture. Customization cannot easily fix inherent design flaws.
D. Optimized prior to the addition of security: This describes the "bolt-on" approach to security, which is widely recognized as the least effective and most expensive method. Retrofitting security onto an optimized system is difficult and often incomplete.

1. National Institute of Standards and Technology (NIST). (2018). Special Publication (SP) 800-160

Vol. 1: Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems.

Section 2.2

Page 11: "Experience has shown that building security in from the start is more effective and less costly than trying to add it on as an afterthought... Addressing security concerns late in the life cycle can result in greater expense

a delay in the delivery of the system

and a less secure system."

2. Ross

R.

McEvilley

M.

& Oren

J. C. (2018). NIST Special Publication (SP) 800-171 Rev. 1: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

Appendix E

Page E-1: Discusses the importance of system security engineering and integrating security requirements into the system development life cycle

emphasizing that "security must be designed and built into systems

not added on as an afterthought."

3. McGraw

G. (2004). Software Security. IEEE Security & Privacy Magazine

2(2)

80-83. https://doi.org/10.1109/MSECP.2004.1281254

Page 81

"Architectural Risk Analysis": The article emphasizes that architectural flaws are a major source of security problems and that "getting the design right is essential." It contrasts this with simply fixing implementation bugs

highlighting the higher cost and impact of design-level vulnerabilities.