Certified Information Systems Security Professional (CISSP) Software Development Security Syllabus

What is Cross-Site Scripting (XSS) and its three main types?

Injection of malicious scripts into web pages viewed by other users. Types: Stored (persistent) XSS, Reflected (non-persistent) XSS, and DOM-based XSS. Prevented by output encoding/escaping and input validation.

What is Cross-Site Request Forgery (CSRF) and how is it mitigated?

An attack that tricks an authenticated user's browser into submitting unwanted requests to a trusted site. Mitigated with anti-CSRF tokens, SameSite cookies, and re-authentication for sensitive actions.

What is a race condition (TOCTOU) vulnerability?

A Time-Of-Check to Time-Of-Use flaw where a resource's state changes between when it is checked and when it is used, allowing an attacker to exploit the gap. Mitigated with atomic operations and proper locking.

What is a privilege escalation vulnerability?

A flaw that allows a user or process to gain higher access rights than authorized — vertical (to higher privilege level) or horizontal (to another user's privileges of the same level).

What is insecure direct object reference (IDOR)?

A broken access control flaw where an application exposes a reference to an internal object (e.g., a file or record ID) and fails to verify authorization, letting an attacker access others' data by manipulating the reference.

What is a covert channel in the context of software security?

An unauthorized communication path that transfers information in a way that violates security policy. Two types: covert storage channels and covert timing channels.

What is a backdoor / maintenance hook?

An undocumented method of bypassing normal authentication, often inserted by developers for testing/maintenance. It is a serious vulnerability if left in production code and should be removed before release.

What is a TOC/TOU attack an example of more generally?

A race condition / state-change attack exploiting non-atomic check-then-act sequences. The lesson: validation and use of a resource must occur atomically.

What is input validation and why is allowlisting preferred over denylisting?

Verifying that input conforms to expected type, length, format, and range before processing. Allowlisting (accept only known-good) is preferred because denylisting (block known-bad) inevitably misses novel malicious patterns.

What is output encoding and what attack does it primarily prevent?

Converting output characters into a safe representation for the rendering context (HTML, URL, JS) so they are treated as data, not code. It primarily prevents Cross-Site Scripting (XSS).

What is the secure coding principle of 'fail securely' (fail-safe defaults)?

When a system fails, it should default to a secure/denied state rather than granting access. Errors should not leave the system in an insecure condition or leak sensitive information.

What is 'defense in depth' as a secure coding/architecture principle?

Applying multiple, layered, independent security controls so that if one control fails, others still protect the asset. No single point of failure protects the system.

What is the principle of least privilege in secure coding?

Granting each user, process, or component only the minimum permissions necessary to perform its function, and only for as long as needed, to limit the impact of compromise.

What is 'economy of mechanism' (keep it simple) in secure design?

Security mechanisms should be as small and simple as possible, because complexity increases the likelihood of flaws and makes design harder to verify.

What is 'complete mediation' as a Saltzer and Schroeder design principle?

Every access to every object must be checked for authorization on every request, rather than caching or assuming prior approval still holds.

What is 'open design' as a security principle?

Security should not depend on the secrecy of the design or implementation ('no security through obscurity'); it should rely on the secrecy of keys/passwords, allowing open scrutiny of the mechanism.

What is 'separation of duties' / 'separation of privilege'?

Requiring more than one condition or person to complete a sensitive action, so that no single individual or component has enough power to compromise the system alone.

What is the 'least common mechanism' principle?

Minimizing shared mechanisms (e.g., shared variables, shared services) among users/processes, because shared resources can become channels for information leakage or unauthorized influence.

What is 'psychological acceptability' in secure design?

Security mechanisms should be easy to use and not impose excessive burden, or users will bypass or misuse them, undermining protection.

What is a sandbox in application security architecture?

An isolated execution environment that restricts a program's access to system resources, containing untrusted or potentially malicious code so it cannot harm the host system.

What is a reference monitor and what enforces it?

An abstract concept that mediates all access between subjects and objects; it must be tamperproof, always invoked, and verifiable. The security kernel is the hardware/software/firmware that implements it.

What is the difference between trusted computing base (TCB) and the attack surface?

The TCB is the totality of protection mechanisms (hardware, software, firmware) responsible for enforcing security policy. The attack surface is the sum of all points where an attacker could attempt entry; secure design minimizes both unnecessary attack surface and TCB complexity.

What are the three main types of application security testing: SAST, DAST, and IAST?

SAST (Static): analyzes source/binary code without executing it (white-box). DAST (Dynamic): tests the running application from outside (black-box). IAST (Interactive): instruments the running app to combine both during testing.

What is fuzzing (fuzz testing)?

An automated dynamic testing technique that feeds malformed, unexpected, or random inputs to an application to discover crashes, memory leaks, and exploitable vulnerabilities.

What is Software Composition Analysis (SCA)?

Tooling that identifies open-source and third-party components in software, detecting known vulnerabilities (CVEs), license risks, and outdated dependencies in the supply chain.

What is the purpose of audit logging for code and configuration changes?

To create a tamper-evident, attributable record of who changed what, when, and why — supporting accountability, non-repudiation, forensic investigation, and detection of unauthorized changes.

What logging best practice prevents an attacker from covering their tracks after compromise?

Forwarding logs in near-real-time to a secure, centralized, write-once/append-only log server (or SIEM) separate from the monitored system, so local log tampering does not destroy the evidence.

What sensitive data should NOT be written to application logs?

Secrets and sensitive data such as passwords, session tokens, API keys, full credit-card numbers, and personally identifiable information (PII) — they must be masked, redacted, or excluded.

What is a Software Bill of Materials (SBOM) and why is it important for supply chain security?

A formal, machine-readable inventory of all components, libraries, and dependencies in a software product. It enables rapid identification of affected systems when a component vulnerability (e.g., Log4Shell) is disclosed.

What security practices apply when acquiring or using third-party/COTS software?

Vendor risk assessment, reviewing security track record and SLAs, code/escrow and SBOM review, validating patches and updates, contractual security requirements, and ongoing monitoring for supply chain compromise.

What is the purpose of defining organizational secure coding guidelines and standards?

To provide developers consistent, enforceable rules (e.g., OWASP, CERT, language-specific standards) on input validation, error handling, cryptography, and authentication, reducing common vulnerabilities and enabling measurable, auditable secure development.