TTUHSC Information Techonology
Home Information Technology Policies

TTUHSC IT Policies

9.5.       INFORMATION SERVICES CODING STANDARDS, SECURITY, AND AUDIT CONTROLS
  1. All application development including web applications will have audit capabilities that will allow the construction of a transaction record of activities.
  2. All developers will be familiar with and follow the standards and practices outlined in the following Microsoft Developers Network Resources:
  3. All developers will periodically review the materials at the following sites as part of their training and skills development.
  4. All developers will periodically participate in Microsoft Security Training Events as part of the on-going training and skills development.  Available events can be located at: http://www.microsoft.com/events/security/default.mspx.
  5. Typical Development Phases and Steps to follow (SDLC):
    • Planning
      • Meet with department
      • Gather requirements
    • Analysis/Design
      • Content gathering by department
      • Content organization
      • Navigation organization
      • Application design (User interface, etc.)
      • Database design
    • Development/Testing
      • Create content pages
      • Content graphics
      • Navigation implementation
      • Application programming
      • Database development
      • IS testing
      • Department testing
      • Edits/modifications
      • Re-test
    • Implementation
      • IS approval
      • Department approval
      • Move to production
        • Content Pages
        • Graphics
        • Database
          • Database schema
          • Data migration/creation
        • Application pages
        • Implement SSL (if applicable)
        • Implement authentication (if applicable)
      • Compliance review (TAC, accessibility, etc.)
      • Security code review
      • Post implementation testing/review
      • Post implementation edits/modifications
      • Final testing/review
      • Final IS approval
      • Final department approval
    • Support/Maintenance
  6. All developers will utilize the following tools:
    • Test Environment -
      Dreamweaver Check In/Check Out for static web page development/maintenance; and Visual Studio with Visual Source Safe for web application development/maintenance.
    • Production Environment -
      All developers will publish to the production environment using the HSC Web Version Control System.
    • Luminis Content Management System -
      All content contributors and managers will use this system to develop, maintain, and publish static content to the TTUHSC web sites.
  7. Prior to writing any code or purchasing any software/system at TTUHSC, all developers will:
    • Document the requirements and functionality of a development project.
    • Review the documented requirements and functionality with the individual(s) or department requesting the development project.
    • Insure that they have a thorough understanding of the development project requirements and functionality.
    • Obtain central IS administrative approval to begin the coding process.
  8. All developers will thoroughly test all code prior to implementation.
  9. All developers will require the requesting individual(s) or department to perform extensive testing of all code prior to implementation.
  10. Developed projects or purchased software/systems will not be moved into the production environment until:
    • All code has been thoroughly reviewed and tested.  This includes conducting compliance and security code reviews.
    • Approval has been obtained from the requesting individual(s) or department and a time frame for production implementation has been agreed upon.
    • Production implementation procedures and requirements have been outlined.  These include, but are not limited to:
      • Changes to IIS.
      • Database structure and data migration.
      • Access privileges
    • Approved by central IS Management.
  11. Web publishing from Test to Production
    • The HSC Web Version Control System will be used to publish content from Test to Production for web applications.
    • The content management system will be used to publish static content from Test to Production.
    • Training on the use of these systems will be provided by Information Services.