CISSP · Domain 8
Software Development Security
About 10% of the exam
Security across the SDLC
- Requirements
- Design
- Develop
- Test
- Deploy
- Operate
- Dispose
- Requirements
- security requirements, abuse cases, classification
- Design
- threat modeling, attack surface, architecture review
- Develop
- secure coding standards, peer review, SAST
- Test
- DAST, fuzzing, penetration test, UAT
- Deploy
- hardening, change control, signed artifacts
- Operate
- patching, monitoring, incident handling
- Dispose
- sanitize data, revoke keys, archive
A defect found in design costs a fraction of one found in production; that is the whole case for shifting left
Development methodologies
- Waterfall
- sequential, one pass, hard to change
- Spiral
- iterative with a formal risk step
- Agile
- short sprints, working software first
- Scrum
- product owner, scrum master, team
- Prototyping
- throwaway model to learn requirements
- RAD
- rapid iterations with user feedback
- DevOps
- dev and ops share the pipeline
- DevSecOps
- security in every phase, automated
- Cleanroom
- formal methods, prevent defects
Maturity models
- CMMI 1 Initial
- ad hoc, heroics
- CMMI 2 Managed
- project-level discipline
- CMMI 3 Defined
- organization-wide standards
- CMMI 4 Quantitative
- measured with metrics
- CMMI 5 Optimizing
- continuous improvement
- OWASP SAMM
- prescriptive, five business functions
- BSIMM
- descriptive, what firms actually do
- IDEAL
- initiate, diagnose, establish, act, learn
Threat modeling in design
STRIDE
- Spoofing
- beat with authentication
- Tampering
- beat with integrity checks
- Repudiation
- beat with logging, signatures
- Information disclosure
- beat with confidentiality
- Denial of service
- beat with availability design
- Elevation of privilege
- beat with authorization
Other methods
- DREAD
- damage, reproducibility, exploitability, users, discoverability
- PASTA
- seven stages, risk and business centric
- VAST
- scales threat modeling to agile teams
- Trike
- risk-based, acceptable risk per asset
- Attack tree
- goal at root, paths as branches
Design practices
- Draw data flows, mark trust boundaries
- Reduce attack surface: fewer entry points
- Write abuse and misuse cases
- Mutual TLS between microservices stops spoofing
- Secure defaults, fail closed
- Review architecture before code exists
Secure coding practices
- Validate input with allowlists, server side
- Encode output for the context
- Parameterized queries, never string concatenation
- Database account with least privilege
- Fail securely, generic error messages
- No hardcoded secrets or keys
- Salted, slow password hashing
- Memory-safe languages remove whole bug classes
- Log security events without sensitive data
DevSecOps and the pipeline
- Shift left: test earliest, fail the build
- Secrets scanning on every commit
- Infrastructure as code scanned like code
- Signed artifacts and SBOM per release
- Separation of duties inside the pipeline
- Blue-green: two environments, instant switch
- Canary: small slice first, auto rollback
- Immutable images, no live edits
- Developers never touch production directly
Application security testing
SAST
- Source or binary, not running
- In the IDE and build stage
- Finds injection sinks, hardcoded secrets
- Noisy, needs triage
DAST
- Attacks the running application
- Staging or test environment
- Finds misconfiguration, auth flaws
- No source required
Beyond the two
- IAST
- agent watches code under test
- RASP
- in-app runtime blocking with context
- SCA
- third-party component vulnerabilities
- Fuzzing
- random malformed inputs
- Symbolic execution
- solves path constraints, costly
- Regression
- old features still work after change
Build stage: SAST and SCA. Staging: DAST and IAST. Production: RASP and monitoring
Memory and low-level flaws
- Buffer overflow
- write past bounds, hijack flow
- Use-after-free
- dangling pointer reused
- Heap spraying
- fill memory to land shellcode
- Format string
- %x reads, %n writes memory
- Integer overflow
- wraparound breaks size checks
- Off-by-one
- loop bound one too far
- ASLR
- randomize addresses, spoil guesses
- DEP, NX
- data pages cannot execute
- Stack canary
- detect overwritten return address
Supply chain and third-party code
- Typosquatting: lookalike package names
- Dependency confusion: public name shadows private
- Pin versions and verify hashes
- Private registry resolves before public
- SCA and SBOM: know what you ship
- Prefer signed packages, vet maintainers
- Evaluate COTS and open source before adoption
- Software escrow if the vendor fails
- API keys and rate limits for partners
Web application attacks
Injection
- SQL injection
- query built from input
- Blind, time-based
- infer data from delays
- NoSQL injection
- operators like $gt, $ne
- Command, LDAP
- shell or directory syntax
- XXE
- external entities, disable them
- SSRF
- server fetches attacker URL, allowlist
Client side
- XSS
- stored, reflected, DOM script injection
- CSRF
- victim browser sends forged request
- Clickjacking
- invisible frame over real button
- Prototype pollution
- __proto__ alters every object
- Defense
- encode, CSP, anti-CSRF tokens, SameSite
Session and logic
- Session fixation
- attacker plants the ID first
- IDOR
- guess the object, skip the check
- Insecure deserialization
- crafted objects run code
- Request smuggling
- proxy and server disagree on length
- Race, TOCTOU
- state changes between check and use
- Rate limiting
- stops brute force and abuse
Databases and data
- ACID
- atomic, consistent, isolated, durable
- Aggregation
- harmless pieces form a secret
- Inference
- deduce restricted data from allowed
- Polyinstantiation
- same key, different rows per level
- Views
- restrict columns and rows shown
- Stored procedures
- help only if parameterized
- Locks
- concurrency without corruption
- Data warehouse
- aggregated, high value target
- Encrypt at rest
- columns or whole database
OWASP Top 10 (2021)
- A01 Broken access control
- A02 Cryptographic failures
- A03 Injection, including XSS
- A04 Insecure design
- A05 Security misconfiguration
- A06 Vulnerable and outdated components
- A07 Identification and authentication failures
- A08 Software and data integrity failures
- A09 Security logging and monitoring failures
- A10 Server-side request forgery
Environments, code and platforms
- Separate development, test, production
- Protect repositories: MFA, branch protection, review
- Code signing proves origin and integrity
- Obfuscation slows, never secures
- Mobile: root detection, no secrets in the app
- API gateway: authenticate, throttle, log
- REST stateless, SOAP with WS-Security
- Low-code and citizen developers still need review
- Acquisition: security requirements in the contract
Rapid recall: OOP and design words
- High cohesion
- module does one thing, good
- Low coupling
- few dependencies, good
- Encapsulation
- hide internals behind methods
- Polymorphism
- same call, type-specific behavior
- Inheritance
- subclass reuses parent
- Garbage collection
- reclaim unused memory automatically
- Covert channel
- unintended data path
- Maintenance hook
- backdoor left by developers
- Attack surface
- every reachable entry point
Know the order: Fagan inspection
- Planning
- Overview
- Preparation
- Inspection
- Rework
- Follow-up
- Formal review with defined roles
- Moderator, author, reader, recorder
- Finds defects, does not fix them in meeting
- Pair programming and tool review are lighter
Threat model in design, review in development, test before release, monitor after: security never gets a single phase
Reference strip: models, tools, attacks, defenses
Frameworks and models
- OWASP SAMM, BSIMM, CMMI, IDEAL
- NIST SSDF (SP 800-218)
- Microsoft SDL, STRIDE, DREAD, PASTA
- ISO 27034 application security
- OWASP ASVS verification standard
Testing and tooling
- SAST, DAST, IAST, RASP, SCA
- Fuzzers, symbolic execution
- Dependency scanners, SBOM generators
- Secrets scanners, IaC scanners
- WAF in front, RASP inside
Attack names
- SQLi, NoSQLi, XSS, CSRF, SSRF, XXE
- Deserialization, request smuggling
- Buffer overflow, use-after-free, format string
- Typosquatting, dependency confusion
- Session fixation, IDOR, TOCTOU
Defenses
- Allowlist validation, output encoding
- Parameterized queries, least privilege DB
- ASLR, DEP, canaries, memory-safe languages
- CSP, SameSite cookies, anti-CSRF tokens
- Salted Argon2 or bcrypt for passwords
Pipeline terms
- CI/CD, shift left, gates
- Blue-green, canary, feature flags
- Immutable infrastructure, IaC
- Signed artifacts, provenance, SBOM
- Code escrow, code signing
Quick exam traps
- Trap: Security review belongs at the end of the SDLC
- Trap: SHA-256 alone is fine for storing passwords
- Trap: Blocklisting input is as good as allowlisting
- Trap: Stored procedures make SQL injection impossible
- Trap: High coupling and low cohesion are design goals
- Trap: SAST replaces the need for DAST
- Trap: Developers need production access to ship faster
- Trap: A canary deployment means testing in an isolated lab
cybercertprep.com · original revision sheet written from the public body of knowledge