ISC2 CSSLP case studies
ISC2 CSSLP · Put your knowledge to work in context.
The ISC2 CSSLP (Certified Secure Software Lifecycle Professional) is a vendor-neutral certification focused on building security into every phase of the software development lifecycle. ISC2 describes it as recognition of leading application security skills - the ability to apply best practices, policies and procedures for authentication, authorization and auditing across the SDLC. It is aimed at professionals responsible for applying those practices from design and implementation through testing and deployment: software architects, engineers and developers, application security specialists, QA testers, penetration testers, program and project managers, procurement analysts, and security or IT managers. The exam is organized around eight domains: Secure Software Concepts; Secure Software Lifecycle Management; Secure Software Requirements; Secure Software Architecture and Design; Secure Software Implementation; Secure Software Testing; Secure Software Deployment, Operations, Maintenance; and Secure Software Supply Chain. The ISC2 CSSLP case studies are 5 cases and about 4,019 words.
1The Patient Portal Requirement That Cannot Be Tested
A healthcare portal team is finalizing requirements for a 12,000-user patient portal. Compliance states that patient records must be retained with a full audit trail for six years.
842 words, about 4 min2Three Weeks to Release With a 31% Refund Module
A payments team has three weeks of test time before a mandatory release. Its suite contains 1,400 automated tests with 62% line coverage overall, but the new refund module sits at 31%.
784 words, about 4 min3Trusted VPC, Shared Credentials, Two SBOMs
A team ships a Java service that depends on an open-source JSON library last updated in 2019. The library brings in three transitive dependencies, and the build resolves all of them from a public repository without checksum verification.
794 words, about 4 min4Forty Services Behind One Trusted Network
An organisation runs 40 microservices in a single shared VPC. All services connect to the database with one account that holds full privileges across every schema.
818 words, about 4 min5The Nine-Point-Eight and the Five-Day Change Board
A public web application has a critical remote code execution vulnerability, CVSS 9.8, in a framework component. The vendor has no patch and estimates 10 days.
781 words, about 4 min