Chapter 8 of 8 · ISC2 CISSP
Software Development Security
Security in the SDLC, development ecosystem controls, assessing software security, acquired software and secure coding.
- 4topics
- 12 minfast track
- 1diagrams and exhibits
- 10%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Security in the Software Development LifecycleIntegrating security into waterfall, agile and DevSecOps lifecycles, maturity models such as CMMI, SAMM and BSIMM, change…3 min
- 2Development Ecosystem ControlsSecurity controls for languages, libraries, IDEs, runtimes, CI/CD pipelines, code repositories and configuration management, plus…Diagram3 min
- 3Assessing Software Security and Acquired SoftwareMeasuring software security with audits, logging, risk analysis and metrics, and assessing commercial, open source, third-party…3 min
- 4Secure Coding Guidelines and StandardsCommon source-code weaknesses and fixes, OWASP and CERT resources, API security, secure coding practices, failure handling and…3 min
About this chapter
What this chapter covers
Software Development Security is worth 10 percent of the CISSP exam. It treats software as something the security manager must govern: how it is built, the tools and pipelines that build it, how its security is measured, the risks of software the organization buys, and the coding standards developers follow.
It covers security in the software development lifecycle (development methodologies, maturity models, operation and maintenance, change management, integrated product teams), security controls in development ecosystems (languages, libraries, tool sets, IDEs, runtimes, CI/CD, configuration management, code repositories, application security testing), assessing software security effectiveness (auditing, logging, risk analysis), the security impact of acquired software (commercial, open source, third-party, managed services) and secure coding guidelines and standards (source-code weaknesses, API security, secure practices, software-defined security).
How the topics fit together
Questions are managerial: which control enforces a coding rule on every commit, how to evaluate a vendor's product, how to keep developers from altering the controls that check their own work.
Automated controls in the pipeline (static analysis gates, dependency scanning, signed artifacts) beat periodic manual checks for anything that must apply to every change.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.