Information Security: Principles and Practices 2nd Edition by Jim Breithaupt, Mark S. Merkow

Exercise 9

Understanding SDLC and Government Regulations

1. Review the provisions of the Security Rule for the Health Insurance Privacy and Accountability Act (HIPAA) as it relates to software development activities (see www.hrsa.gov/healthit/toolbox/HealthITAdoptiontoolbox/PrivacyandSecurity/hipaarules.html).

2. Review the provisions of Section 404 of the Sarbanes-Oxley Act as it relates to software development activities (see http://msdn.microsoft.com/en-us/library/aa480484.aspx).

3. What role does the SDLC play in compliance with these regulations?

---

4. What should software security specialists do to help their organizations comply?

---

5. How can software security specialists help IT auditors better understand what controls are necessary and operating as intended?