You are planning a wireless implementation. At what point should you begin to consider security requirements for the implementation?

Security is a fundamental requirement that must be integrated into every phase of a project's lifecycle, beginning at its inception. This principle is often referred to as "security by design." The planning phase is the earliest and most critical stage to define security requirements, policies, and architecture. Addressing security from the start ensures that the entire wireless implementation is built on a secure foundation, which is far more effective and less costly than attempting to add security measures during or after implementation. Waiting until later phases introduces significant risk and often requires expensive rework.

A. During hand-off to support: This is far too late. The system is already designed and built; discovering security needs at this point would be a catastrophic failure in project management.

C. In the implementation phase: While security controls are configured during implementation, the requirements and overall design must be established during the preceding planning phase.

D. In the acceptance testing phase: This phase is for validating that the implementation meets the pre-defined requirements. Introducing new security considerations here indicates a major planning oversight.

1. National Institute of Standards and Technology (NIST) Special Publication 800-64 Rev. 2, Security Considerations in the System Development Life Cycle.

Reference: Section 2.1, "Integrating Information Security into the SDLC," states, "The traditional system development life cycle (SDLC) consists of five phases: initiation, acquisition/development, implementation, operations/maintenance, and disposition. Security must be integrated into each of these phases." The "initiation" phase, where the need for a system is expressed and its purpose is documented, is analogous to the "planning phase" in the question.

2. Carnegie Mellon University, Software Engineering Institute (SEI), Security Quality Requirements Engineering (SQUARE).

Reference: The SQUARE methodology, a widely recognized academic and industry model, explicitly places security requirement elicitation and definition at the beginning of the development lifecycle, prior to architectural design and implementation. This reinforces the principle of addressing security in the earliest planning stages. (See technical reports like CMU/SEI-2005-TR-009).

3. MIT OpenCourseWare, 16.355J Software Engineering Concepts.

Reference: Course materials on the software development lifecycle emphasize that non-functional requirements, such as security, performance, and reliability, must be defined during the initial requirements and specification phase (the planning phase). Failing to do so is a common cause of project failure.