CISSP Domain 8 Guide: Software Development Security

What Domain 8 covers

• SDLC models and where security fits in each
• Maturity models and secure development practices
• Change and configuration management in development
• Security of development environments and toolchains
• Assessing the effectiveness of software security
• Acquired software: commercial, open source, cloud and managed services
• Secure coding standards and common weaknesses
• Database security and aggregation risk

SDLC models

The universal exam point: security requirements belong in the requirements phase. Fixing a defect after release costs enormously more than designing it out, and 'shift left' is the expected answer.

Common weaknesses to recognise

• Injection (SQL, command, LDAP) — counter with parameterised queries and input validation, not blacklists.
• Cross-site scripting — counter with output encoding plus input validation.
• CSRF — counter with anti-forgery tokens and SameSite cookies.
• Buffer overflow — counter with bounds checking, ASLR, DEP and safe languages.
• TOCTOU — a race between check and use; counter with atomic operations and locking.
• Insecure deserialisation and hard-coded secrets — counter with secret management and validated input.

Third-party and acquired software

• Open source is not inherently less secure, but you own the risk of what you import — maintain a software bill of materials.
• Commercial software needs contractual security terms, patch commitments, and a right to assess.
• Cloud and managed services shift responsibility, never accountability. Know the shared responsibility split for IaaS, PaaS and SaaS.
• Escrow protects against vendor failure for critical bespoke software.

Database security

• Aggregation — combining individually harmless data into something sensitive.
• Inference — deducing sensitive data from what you can legitimately see; counter with polyinstantiation and query controls.
• ACID — atomicity, consistency, isolation, durability. Integrity properties, and exam-favoured vocabulary.
• Views and stored procedures enforce least privilege better than granting table access.

Study checklist

1. Explain where security requirements enter each SDLC model.
2. Match each common weakness to its primary countermeasure.
3. Explain the shared responsibility model across IaaS, PaaS and SaaS.
4. Distinguish aggregation from inference with an example.

Frequently asked questions