Define user documentation
Written or other visual information about an application system, how it works, and how to use it. (17)
.
User documentation refers to the documentation for a product or service provided to the end users. The user documentation is designed to assist end users to use the product or service. This is often referred to as user assistance. The user documentation is a part of the overall product delivered to the customer.
The sections of a user manual often include: * A cover page * A title page and copyright page * A preface, containing details of related documents and information on how to navigate the user guide * A contents page * A guide on how to use at least the main functions of the system * A troubleshooting section detailing possible errors or problems that may occur, along with how to fix them * A FAQ (Frequently Asked Questions) * Where to find further help, and contact details * A glossary and, for larger documents, an index

realized the importance of documentation many years ago when I joined an organization to head its IT function. The previous IT head had left the organization a couple of months ago. The managing director called me over and voiced his expectation. He told me that all ground work had been done for ordering new set of servers and application packages and that I should act upon it soon. I promised to take a look at the situation and revert with plans.
However, when I sat in my department and rummaged through papers, I could not find much except notes on discussions with the vendor and details of configuration. For instance, there was no document showing an IT plan, applications to be developed / bought, functional areas to be covered, priority of tasks and justification for the equipment and software to be bought. When I went back to the boss expressing my helplessness in the absence of documentation, he was visibly annoyed and refused to discuss further. I then spent the next three months drawing out fresh plans and submitted them for approval.
Having learnt the lesson, I made it a point to always submit a handing over report to the management whenever I left any organization, which carried details on the IT set up, current status on various tasks, pending work, and the matters that would need attention in the following six months.
Consequences of poor documentation
Proper documentation is essential at every stage of our working and it doesn’t have to wait for a specific occasion. Documentation is simply a habit and a discipline and contrary to what many think, it does not require great effort. Good practices speak of creating documentation alongside and not to wait for the entire work to be over. I have faced several embarrassing situations due to lack of documentation. In one case, my assistant misplaced documents relating to approvals and vendor negotiation thus attracting auditor’s comments for loss of control.
Failure to record discussions and agreement with users has often lead to damning arguments during implementation stages. Not documenting system specs has got many of us in trouble. Absence of software specifications or incomplete specs makes many a developer code again rather than trying to rectify an earlier program. Lack of proper recording of approvals for user rights in the user profile can be a serious lapse and may cede ground for frauds to be committed.
Documentation involves creating documents to record details / specification / events or storing and preserving documents that are relevant. They are important for the purposes of recording details of various activities, for retaining as evidence, for documenting policies & rules, for exercising control, preserving for posterity or as instruction for work to be done.
 IMPORTANCE
The basic importance of documentation is to help learn from the design, development, implementation and re-evaluation experience which is used to create a record as well as help in future evaluation or modification.

 IMPORTANCE
Documentation of processes helps in creating systematic information to articulate the intervention strategies and develop the flow chart of a system

 IMPORTANCE
Benefit is not only enjoyed by the system evaluated but also other similar projects and can use the outcome as a model in their formulation and implementation methods.

 IMPORTANCE
Documentation is also used by agencies undertaking new and complex forms as part of expansion of systems

 CONCLUSION
Documentation is a much ignored but absolutely important part of every stage in the System Development Life Cycle of any system. A well written and organized documentation makes the work of future system user in any stage easier.

 With the help of documentation it is very easy to track the flow of the system's progress and the workings of the system can be explained very easily.

 USES
It facilitates effective communication regarding the system between the technical and the non technical users.

 USES
It is very useful in training new users

 USES
Documentation also helps the users to solve problems like trouble shooting

 USES
It plays a significant role in evaluation process.

 USES
It not only helps to exercise better control over the internal and external workings of the firm.

 USES
Documentations can help the manager to better quantify the financial ramifications/footprint of the system.
Cat2.

Changeover - ****Most critical and chaotic period of entire SecSDLC***** Changeover is the process of putting the new security system online and retiring the old system. The types of changeovers are as follows: 1. Parallel 2. Direct (also called Immediate) 3. Phased 4. Pilot

Parallel Changeover – is the most popular – Lowest risk. Old system can be reverted back to if necessary. Disadvantages – Expensive and time-consuming. (Most costly) Which system caused the error? Parallel tends to delay the adoption of the new system. Have to maintain both systems. Extra workload to operate both systems.

Advantages - Low risk, outputs can be compared to ensure that the new system is functioning correctly. When IT staff and management are satisfied with the outputs of the new system, the old system can be terminated.
Parallel Conversion is not practical if the old and new system is totally different in processing tasks, functions, input, or output.

Pilot Changeover - (some risk) Implement the new system at a selected location of the company, such as only one branch office. The first group to use the new system is called the pilot site. The old system is still running at the pilot site and for the rest of the organization. After the system proves successful at the pilot site, it is implemented into the rest of the organization, usually using the direct changeover method. Pilot conversion is a "semiparallel" and direct changeover method. Operating both systems at only one site is not as expensive.

Direct or Immediate Replacement – (Most risky) Plug in “new” and unplug “old”. Outputs of both systems are compared. Direct or Immediate replacement is done when: 1. High percentage of Outputs are new 2. System is not so critical that failure is a disaster 3. Parallel processing is not possible 4. Pressure for Outputs 5. Fall Back system is not available

Phased Changeover – (some risk) Compromise between Immediate/Direct and Parallel – it is recommended over the other two methods. Put one module on the system at a time. Team groups working together during implementation allows the new system to be implemented in stages or modules. Ex. Installing a new financial system. First implement accounts payable, then receivables, then payroll, all in stages instead all at one time. What is the difference between Pilot and Phased Changeover? Pilot gives one location the entire system at a time, while Phase gives one module of the system to all users at a time.
Advantages - Risk of errors affects one module at a time only, not the entire system. Less expensive.
Disadvantages - Takes longer since each phase must be implemented separately.

External and Internal Threats
Security threats can come from two locations: * External users * Internal users
An external security threat occurs when someone outside your network creates a security threat to your network. If you are using an intrusion-detection system (IDS), which detects attacks as they occur, you probably will be mildly shocked at the number of probes and attacks that occur against your network daily.
An internal security threat occurs when someone from inside your network creates a security threat to your network. Interestingly, the CSI study has found that, of the 70 percent of the companies that had security breaches, 60 percent of these breaches come from internal sources. Some of these security breaches were malicious in intent; others were accidental. Therefore, you should not just be concerned about protecting the perimeter of your network, you should also aim to protect every key resource and service. This topic is discussed in more depth in Chapter 2, "Introduction to Firewalls."
CAUTION
Most security threats are internal. Therefore, when you design a security solution, you must address this issue by using internal measures to protect important resources.

Unstructured and Structured Threats
General methods of security threats fall under two categories: * Unstructured threats * Structured threats
An unstructured security threat is one created by an inexperienced person who is trying to gain access to your network?a wannabe hacker. A good security solution easily should thwart this kind of attack. Many tools available to anyone on the Internet can be used to discover weaknesses in a company's network. These include port-scanning tools, address-sweeping tools, and many others. Most of these kinds of probes are done more out of curiosity than with a malicious intent in mind. This is especially true of internal users who are interested in what kinds of devices exist in their own network.
A structured security threat, on the other hand, is implemented by a technically skilled person who is trying to gain access to your network. This hacker creates or uses some very sophisticated tools to break into your network or to disrupt the services running in your network. A good example of a structured attack is a distributed ICMP flood. A person with very little hacking skill probably would send a flood of pings from the same source machine, making it fairly easy to track down the culprit. A sophisticated hacker, on the other hand, will try to hide the source of the ICMP packets by changing the source address inside the packets (called spoofing), as well as executing the attack from several different sources. Tracking down the culprit of this kind of attack takes a lot of work and patience.
 Adaptive – modifying the system to cope with changes in the software environment (DBMS, OS) [4]
 Perfective – implementing new or changed user requirements which concern functional enhancements to the software
 Corrective – diagnosing and fixing errors, possibly ones found by users [4] *  Preventive – increasing software maintainability or reliability to prevent problems in the future [ Corrective maintenance: Reactive modification of a software product performed after delivery to correct discovered problems. * Adaptive maintenance: Modification of a software product performed after delivery to keep a software product usable in a changed or changing environment. * Perfective maintenance: Modification of a software product after delivery to improve performance or maintainability. * Preventive maintenance: Modification of a software product after delivery to detect and correct latent faults in the software product before they become effective faults. cat 2
Logical data modeling
The process of identifying, modeling and documenting the data requirements of the system being designed. The result is a data model containing entities (things about which a business needs to record information), attributes (facts about the entities) and relationships (associations between the entities).
Data Flow Modeling
The process of identifying, modeling and documenting how data moves around an information system. Data Flow Modeling examines processes (activities that transform data from one form to another), data stores (the holding areas for data), external entities (what sends data into a system or receives data from a system), and data flows (routes by which data can flow).
Entity Event Modeling
A two-stranded process: Entity Behavior Modeling, identifying, modeling and documenting the events that affect each entity and the sequence (or life history) in which these events occur, and Event Modeling, designing for each event the process to coordinate entity life histories