Certified Information Systems Security Professional (CISSP) Software Development Security Syllabus

Software Development Security syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Software Development Security in Certified Information Systems Security Professional (CISSP), not a summary of it.

1. 1

   Security in the Software Development Lifecycle

   3 topics

   • Development Methodologies
     • Waterfall, spiral, and Agile
     • DevOps and DevSecOps integration
     • Capability Maturity Model
   • Security Throughout the SDLC
     • Requirements and design security
     • Secure coding, testing, and deployment
     • Operations, maintenance, and disposal
   • Change and Configuration Management in Development
     • Version control and code repositories
     • Build and release management
     • Software configuration management
2. 2

   Secure Coding and Common Vulnerabilities

   3 topics

   • Common Software Vulnerabilities
     • Injection flaws (SQL, command, LDAP)
     • Cross-site scripting and CSRF
     • Buffer overflows and memory corruption
     • Broken authentication and access control
   • Secure Coding Practices
     • Input validation and output encoding
     • Error handling and secure defaults
     • Use of security APIs and frameworks
     • OWASP Top 10 mitigation
   • Application Security Architecture
     • Programming language and runtime security
     • Libraries, toolsets, and SDKs
     • Application programming interface security
3. 3

   Assessing Software Security Effectiveness

   3 topics

   • Auditing and Logging Code Changes
     • Audit trails for development activity
     • Risk analysis and mitigation in code
   • Acquired Software and Supply Chain
     • Commercial off-the-shelf software risk
     • Open-source and managed services risk
     • Software composition analysis and SBOM
   • Defining Secure Coding Guidelines
     • Establishing coding standards
     • Security weakness and vulnerability databases
     • Defining acceptance criteria for security

Software Development Security flashcards for Certified Information Systems Security Professional (CISSP)

21 of 51 cards from the Software Development Security deck — real questions with worked answers.

1. What is the Waterfall software development methodology?

   A linear, sequential model where each phase (requirements, design, implementation, testing, deployment, maintenance) must be completed before the next begins, with little backtracking. Best for stable, well-understood requirements.

2. How does the Agile methodology differ from Waterfall?

   Agile is iterative and incremental, delivering working software in short sprints with continuous customer feedback and adaptive planning, whereas Waterfall is rigid, sequential, and front-loads all requirements. Agile values responding to change over following a fixed plan.

3. What is the Spiral software development model and what is its defining feature?

   A risk-driven iterative model that repeats four phases (determine objectives, identify/resolve risks, develop/test, plan next iteration) in expanding loops. Its defining feature is explicit, repeated risk analysis at each spiral.

4. What does DevOps integrate, and what does DevSecOps add?

   DevOps integrates development and IT operations to enable continuous integration/continuous delivery (CI/CD). DevSecOps adds security as a shared responsibility throughout the pipeline, embedding automated security testing early ('shift left').

5. In the CISSP/SAMM context, what are the five levels of the Capability Maturity Model (CMM/SW-CMM)?

   1) Initial (ad hoc/chaotic), 2) Repeatable (basic project management), 3) Defined (documented/standardized processes), 4) Managed (quantitatively measured), 5) Optimizing (continuous process improvement).

6. What does IDEAL stand for in the software process improvement model?

   Initiating, Diagnosing, Establishing, Acting, and Learning — a five-phase model (from SEI) for guiding software process improvement.

7. What is the principle of 'shift left' in secure software development?

   Moving security activities (threat modeling, testing, code review) earlier into the SDLC, since defects found earlier are far cheaper and easier to fix than those found in production.

8. List the typical phases of the System/Software Development Life Cycle (SDLC).

   Initiation/planning, requirements/functional analysis, system design, development/coding, testing/acceptance, implementation/deployment, operations & maintenance, and disposal/decommissioning.

9. At which SDLC phase should threat modeling first be performed, and why?

   During the design (and requirements) phase, so that security threats are identified and mitigated through architecture before code is written, when changes are cheapest.

10. What security activity belongs to the SDLC requirements phase?

    Defining security and privacy requirements, abuse/misuse cases, regulatory/compliance obligations, and an initial risk assessment to establish the security baseline for the project.

11. What is a security 'gate' (or quality gate) in the SDLC?

    A control checkpoint between phases where deliverables must meet defined security criteria (e.g., passing threat model review or static analysis) before the project may proceed.

12. What is certification versus accreditation in deploying software/systems?

    Certification is the technical evaluation of security controls against requirements; accreditation is management's formal authorization to operate the system, accepting the residual risk.

13. What is the purpose of change management in software development?

    To ensure all modifications to code, systems, or configurations are formally requested, reviewed, approved, tested, documented, and tracked, preventing unauthorized or destabilizing changes.

14. What are the typical steps of a formal change management process?

    1) Request the change, 2) Review/impact analysis, 3) Approve or reject (via Change Advisory Board), 4) Test the change, 5) Schedule and implement, 6) Document, 7) Report/review results.

15. What is a Change Advisory Board (CAB)?

    A group of stakeholders that evaluates, prioritizes, approves, and schedules proposed changes, assessing their risk and impact before implementation.

16. What is configuration management (CM) and its core activities?

    The process of identifying, controlling, and documenting the configuration of system components. Core activities: configuration identification, configuration control, configuration status accounting, and configuration auditing/verification.

17. What is a software baseline in configuration management?

    A formally reviewed and agreed-upon snapshot of a configuration item at a point in time that serves as a reference; subsequent changes are made only through formal change control.

18. What is version control and why is it a security control?

    A system that tracks every change to source code with history, authorship, and the ability to roll back. It supports accountability, integrity, audit trails, and recovery from malicious or erroneous changes.

19. What is a buffer overflow vulnerability?

    When a program writes more data to a buffer than it can hold, overwriting adjacent memory. Attackers can use it to crash the program or inject and execute arbitrary code. Mitigated by bounds checking, safe functions, ASLR, DEP/NX, and stack canaries.

20. What is SQL injection and how is it prevented?

    An attack that inserts malicious SQL through unsanitized input to manipulate a database query. Prevented with parameterized queries/prepared statements, stored procedures, input validation, and least-privilege database accounts.

21. What is Cross-Site Scripting (XSS) and its three main types?

    Injection of malicious scripts into web pages viewed by other users. Types: Stored (persistent) XSS, Reflected (non-persistent) XSS, and DOM-based XSS. Prevented by output encoding/escaping and input validation.

See more Software Development Security flashcards →

Planning Software Development Security for Certified Information Systems Security Professional (CISSP)

Software Development Security (Certified Information Systems Security Professional (CISSP)) FAQ