Chapter 6: Foundations for Systems Design

what does systems analysis provide

the starting point for design

what is systems design

provides the starting point for implementation

define, organize, and structure the components of the final solution to serve as a blue print for construction

• how we build to meet the needs of a business

Design is a model building activity!

• What does the system do to meet the needs of a business

diagram of how analysis and design connect

what are design models

how is its formality decided, and why do we need it

• Design is a model building activity

• The formality of the project will dictate the type, complexity, and depth of models

• Agile/iteration projects typically build fewer models, but models are still created

• Jumping to programming without design often causes less than optimum solutions and may require rework

how requirement models become design models

• Shifting from process and requirements to how it will acc look in design (implementation)

  • Like servers, client computers, networking

what are design activites

Design activities correspond to components of the new system

• The environment

• Application components

• User interface

• Database

• Software classes and methods

• ex. What are we using for the house? Sheet rock, wood metal, etc

what is core process 4?

Design system components

steps in core process 4: design system components

• Describe the environment

• Design the components,interface, database, and classes and methods

Key design questions

• What questions align with each activity?

• Ex. describing the environment → how will the system interact with other systems? What integration or environment specifics do we need to know?

two key elements in an environment

communications with external systems

conforming to an existing technology architecture

communications with external systems

Message formats

Web and networks

Communication protocols

Security methods

Error detection and recovery

conforming to an existing technology architecture

Discover and describe existing architecture

Chapter 7 provides more details

what is an application component

a well defined unit of software that performs some function(s)

Issues involve how to package components including:

• Scope and size – what are the functions, boundaries, interfaces?

• Programming language – what are the accepted languages?

• Build or buy – is an acceptable version available to purchase?

Models produced during the activity: Design the application components

3 types

Component diagram

package diagram

deployment diagram

what does it mean to design the user interface

• To the user, the User Interface is the system.

• The user interface has large impact of user productivity

• Includes both Analysis and Design tasks

  • Requires heavy user involvement

• Current needs require multiple user interfaces

  • Many different devices and environments

Models produced during the activity: Design the user interface

Storyboard

system sequence diagram

small screen menu prototype

Current technology frequently uses what kind of database management systems?

what does using this require?

Relational Database Management Systems (RDBMS)

• Requires converting the data model to a relational database

• Requires addressing of many other technical issues

  • Throughput and response time

  • Security

Sample database table definition in MYSQL

what does it mean to design software classes and methods —> what 3 models do you make

AKA Detailed Design

A model building activity

• Design Class Diagram

• Sequence Diagrams

• State-Machine Diagrams

Typical design class diagram with attributes and met-____

example

Partial design class diagram for RMO’s CSMS

view layer

domain layer

data access layer

(CHECK)

View layer - what user sees

Domain layers - context with which u are building for

Data access layer - beginning to end, how the application transacts

Integrity Controls

Controls that maintain integrity of inputs, outputs and data and program

Security Controls

Controls that protect the assets from threats, internal and external

Integrity and security controls diagram

what are integrity controls integrated into

Integrated into application programs and DBMS

Objectives of Integrity Controls

Ensure that only appropriate and correct business transactions are accepted

Ensure that transactions are recorded and processed correctly

To protect and safeguard assets such as the database

what are input controls

four types of input controls

• Value Limit Controls

• Completeness Controls

• Data Validation Controls

• Field Combination Controls

Prevent invalid or erroneous data from entering the system

Value Limit Controls

• Check the range of inputs for reasonableness

Completeness Controls

• Ensure all the data has been entered

Data Validation Controls

• Ensure that specific data values are correct

Field Combination Controls

• Ensure data is correct based on relationships between fields

what are output controls

examples

To ensure that output arrives at proper destination (for authorized eyes) and is accurate, current, and complete

examples:

• Physical access to printers and display devices

• Discarded data – protect from “dumpster diving”

• Labels on printed and electronic output to correctly identify source of data

• 
  

what is the point of redundancy, backup and recovery

Protect data and systems from catastrophes

• Databases

• Hardware

• Software applications

• Networks

On-site versus off-site copies

what is fraud prevention

one of the biggest threats to cybersecurity is internal malicious actors 

• Ex. a frustrated employee, ex. Someone who did not get promoted, knows enough about the company to embezzle the money

Critical to prevent internal fraud, embezzlement, or loss

Fraud triangle

• Opportunity

• Motive

• Rationalization

fraud risk factors and techniques

what is the point of security controls

Protect all assets against external threats

Other objectives

• Protect and maintain a stable, functioning operating environment 24/7 (equipment, operating systems, DBMSs)

• Protect information and transactions during transmission across networks and Internet

four main parts of designing security controls + subparts

• Access Controls – Limit a person’s ability to access servers, files, data, applications

  • Authentication – to identify users

    • Multifactor Authentication

  • Access control list – list of valid users

  • Authorization – authenticated user’s list of permission level for each resource

• Registered Users – those with authorization

• Unauthorized Users – anyone not registered

• Privileged Users – those that maintain lists and systems

types of users

what is data encryption

Method to secure data – stored or in transmission

encryption

alter data so it is unrecognizable

decryption

converted encrypted data back to readable format

encryption algortihm

mathematical transformation of the data

encryption key

a long data string that allows the same algorithm to produce unique encryptions

symmetric key encryption

Encryption method that uses the same key to encrypt and decrypt

asymmetric key encryption

Encryption method that uses different keys to encrypt and decrypt

• AKA Public Key Encryption

digital signature

technique where a document is encrypted using a private key

• Note – implements previous slide, but in reverse

  • Document is encrypted with private key, but then can only be decrypted with correct public key

digitial certificate

assure us that we are doing business with a valid entity

An organizations name and public that is encrypted and certified by an authorized third party

certifying authority

the authorized third party

• Widely known and accepted – built into Web browsers

Secure Sockets Layer (SSL)

standard set of protocols for authentication and authorization

SSL is outdated, we use TLS now! 

• Ppl still say SSL by accident sometimes, but they acc mean to use TLS

Transport Layer Security (TLS)

an Internet standard equivalent to SSL

IP Security (IPSec

Internet security protocol at a low-level transmission

ex. HTTPS ensures all traffic on internet is going through a TLS process (http does not)

why is separation of duties important

allows for risk eduction

• Records and audit trails

• Monitoring

• Asset tracking (???)

• Check what else is on the textbook

registered users

someone who registers into the system- managers, employees, system admin users

when can we not use symmetric keys? What is the solution to that

Cant use symmetric keys if we don't know who the recipient is, or if there are evesdroppers

• So we use asymmetric keys

Hypertext Transfer Protocol Secure (HTTPS)

Internet standard to transmit Web pages

• an encrypted version of the protocol used to transmit data between a web browser and a website, ensuring that the communication remains private and protected from tampering.

analysis vs design and the bridge

Analysis is fact finding and modeling

Design is modeling to specify how system will be implemented

Design is bridge between analysis an implementation