Software Development Security
CISSP Domain 8 in depth at a management level: security activities, requirements, abuse cases and gates across the SDLC, secure design principles and application threat modelling with STRIDE, waterfall, agile and DevSecOps with CMMI, OWASP SAMM, BSIMM and the NIST SSDF, securing repositories, secrets, build pipelines and signing with SLSA provenance, secure coding for input, output, authentication, sessions, cryptography, errors and logging, the OWASP Top 10 2025 and CWE Top 25 vulnerability classes and their defences, database security, aggregation and inference, code review and SAST, DAST, IAST, SCA and fuzzing, software supply chain security with SBOMs and VEX, the Critical Cyber Systems Protection Act, CPCSC and the EU Cyber Resilience Act, acquired software, low-code and AI-assisted development, ending in a capstone program and exam strategy.
CISSP-117 12 lessons · 5 h 17 min
Offered by HSM University · CISSP Exam Prep
This is the Canadian version of this course. See the American version.
What you'll learn
- Integrate security activities, evidence and gates into every phase of the software development life cycle, and write specific, testable security requirements and abuse cases
- Apply secure design principles and secure-by-default expectations, and lead application threat modelling with data flow diagrams, trust boundaries and STRIDE
- Fit security into waterfall, agile, DevOps and DevSecOps delivery, and use CMMI, OWASP SAMM, BSIMM and the NIST SSDF to assess and improve maturity
- Protect the development ecosystem, including workstations, repositories, secrets, build systems, signing keys, artefact repositories and test data, using SLSA provenance levels
- Define enforceable secure coding standards for input validation, canonicalization, parameterized queries, context-aware output encoding and safe handling of files and commands
- Specify secure authentication, password storage, session management, CSRF protection, cryptographic use, error handling and security logging in application code
- Recognize the major application vulnerability classes in the OWASP Top 10 2025 and CWE Top 25, explain their causes and select preventive, detective and corrective controls
- Secure databases used by applications through ACID transactions, least-privilege accounts, controls against aggregation and inference, polyinstantiation, tokenization and API design
- Choose and govern code review, SAST, DAST, IAST, SCA, fuzzing, penetration testing and disclosure programs, and turn findings into prioritized risk reduction
- Manage software supply chain risk with SBOMs, VEX, component approval, pinned and proxied dependencies, provenance and lessons from SolarWinds, Log4Shell and xz Utils
- Assess acquired software and services through requirements, attestations, contracts and escrow, govern low-code platforms, and control the risks of AI-assisted development
- Design and measure a secure development program with coverage, efficiency and outcome metrics, map it to Canadian, US and EU requirements, and apply a manager's judgement to Domain 8 exam questions
Course content
12 lessons · 5 h 17 min total · final exam
- 1 Security in the software development life cycle 33 min · quiz
- 2 Secure design principles and threat modelling for applications 26 min · quiz
- 3 Development methodologies, DevSecOps and maturity models 26 min · quiz
- 4 Securing the development environment and the delivery pipeline 27 min · quiz
- 5 Secure coding I: input, output and data handling 26 min · quiz
- 6 Secure coding II: authentication, sessions, cryptography and errors 26 min · quiz
- 7 Application vulnerabilities and their mitigations 27 min · quiz
- 8 Databases and data security in applications 25 min · quiz
- 9 Code review and application security testing 25 min · quiz
- 10 Software supply chain security 26 min · quiz
- 11 Acquiring software securely and AI-assisted development 25 min · quiz
- 12 Capstone: a secure development program for an organization, with Domain 8 exam strategy 25 min · quiz
- E Final exam 20 questions
Requirements
Recommended background. You can start any course at any time.
Description
CISSP Domain 8 in depth at a management level: security activities, requirements, abuse cases and gates across the SDLC, secure design principles and application threat modelling with STRIDE, waterfall, agile and DevSecOps with CMMI, OWASP SAMM, BSIMM and the NIST SSDF, securing repositories, secrets, build pipelines and signing with SLSA provenance, secure coding for input, output, authentication, sessions, cryptography, errors and logging, the OWASP Top 10 2025 and CWE Top 25 vulnerability classes and their defences, database security, aggregation and inference, code review and SAST, DAST, IAST, SCA and fuzzing, software supply chain security with SBOMs and VEX, the Critical Cyber Systems Protection Act, CPCSC and the EU Cyber Resilience Act, acquired software, low-code and AI-assisted development, ending in a capstone program and exam strategy.