CYBER LIBRARY
Explore the bootcamp
Making change happenBeginner

Waterfall delivery

Plan sequential stages when requirements and dependencies justify them.

3 min readUpdated 12 Oct 20264 connections
Markdown

The idea

Waterfall-style delivery organizes work into relatively sequential phases, often with defined requirements, design, implementation, testing, and release. It can help where approvals, procurement, or fixed dependencies require staged decisions. The risk is discovering important feedback too late. Practical approaches may include prototypes and iterative checks within phases. Choose the method based on uncertainty and constraints rather than treating the label as a guarantee of control.

In practice

A facility security upgrade follows procurement and installation stages, while testing key assumptions before expensive irreversible work.

A common misunderstanding

Sequential planning does not mean changes are impossible, but they need evaluation and may be costly.

Check your understanding

When is early feedback especially important?

Think it through: When requirements or technical assumptions are uncertain and mistakes would be expensive to correct later.

Sequential work needs trustworthy handoffs

A waterfall approach organizes work through planned stages with outputs that feed later stages. It can fit situations where major requirements are stable, dependencies are well understood, and late changes are costly. Its practical challenge is discovering a mistaken assumption after downstream work has already relied on it. Reviews and early technical validation can reduce that risk.

Security work often contains both predictable and uncertain parts. Purchasing a standard hardware component may be straightforward, while integrating an unfamiliar legacy application may require experimentation. Labeling the whole project waterfall should not prevent a small prototype from resolving that integration uncertainty before detailed implementation proceeds.

A fictional facility migration

An organization moves a server room and must coordinate power, physical access, network connectivity, transport, and service restoration. Some activities require a clear sequence and approved readiness checks. The team plans those dependencies carefully because discovering a missing power requirement on moving day would have serious consequences.

It also rehearses a representative service migration before the final move. That rehearsal is compatible with structured planning: it improves the evidence used to approve the later stage. If the rehearsal reveals a significant design problem, change control should evaluate the impact instead of treating the original plan as unquestionable.

Identify the expensive assumption

For a fictional replacement of a security appliance, list the stage outputs required before installation. Choose one assumption that would be costly to discover wrong at the end, such as compatibility with a required network path. Describe an early test that could check it. Then explain how a failed test should affect the plan. Sequential delivery works better when its handoffs contain verified information rather than confident guesses.

Keep exploring

GO TO THE SOURCE

References & further reading

Original explanations, with primary references for deeper study.

UK Government: Project Delivery Functional Standard
EXPLORE THIS IDEA’S CONNECTIONS

A small part of a bigger picture.

5 notes · 5 connections
100%
Waterfall delivery · depth 1
Drag to pan · Pinch or use +/− to zoom · Click to preview · Double-click to read
Browse notes as a list (5)
FOLLOW ANOTHER THREADExplore the rest of the library
Start with a concept. Follow its connections.
Detection & responseAbuse Elevation Control MechanismElevation-control abuse bypasses or misuses mechanisms governing privileged execution.Making change happenAcceptance criteriaDefine observable conditions for a deliverable to be accepted.Security essentialsAccess controlUnderstand subjects, resources, permissions, and enforcement through a shared-drive example, including how access changes over time.Detection & responseAccess Token ManipulationAccess token manipulation changes or adopts operating-system security contexts.Risk & resilienceAccount Access RemovalAccount access removal disrupts legitimate users by changing, deleting, or restricting their identities.Evidence & investigationAccount DiscoveryAccount discovery enumerates identities available in a system or environment.Detection & responseAccount ManipulationAccount manipulation changes identity settings to preserve or expand access.Adversarial thinkingAcquire InfrastructureInfrastructure acquisition obtains domains, servers, or other resources used to support operations.Adversarial thinkingActive ScanningActive scanning probes target infrastructure to learn reachable services or weaknesses.Security essentialsAdversary in the middleAn intermediary may observe or alter a communication path.Security essentialsAESA symmetric block cipher whose safe use depends on its mode and implementation.Making change happenAgile deliveryUse short feedback cycles to adapt toward a useful outcome.