ISC2 CSSLP study guide
ISC2 CSSLP · Work through your exam, one topic at a time.
The ISC2 CSSLP (Certified Secure Software Lifecycle Professional) is a vendor-neutral certification focused on building security into every phase of the software development lifecycle. ISC2 describes it as recognition of leading application security skills - the ability to apply best practices, policies and procedures for authentication, authorization and auditing across the SDLC. The ISC2 CSSLP study guide has 8 sections and about 2,479 words.
01Secure Software Concepts
Secure software concepts are the vocabulary every other domain builds on. Confidentiality, integrity, and availability (CIA) are the properties; authentication, authorization, auditing/accountability, and non-repudiation are the supporting services.
295 words, about 1 min02Secure Software Lifecycle Management
Secure lifecycle management turns security from a final review into a program. Be able to place each activity in the right phase: policy, roles, and training anywhere; risk classification and security requirements during initiation and requirements; threat modeling and architectural risk analysis in design; standards, code review, and static analysis in implementation; security testing in verification; hardening and release review in deployment; monitoring, patching, and disposal in operations and retirement.
332 words, about 2 min03Secure Software Requirements
Security requirements state what the system must protect and how well, in terms a test can verify. Separate functional requirements (what the system does) from nonfunctional or quality requirements (how well it does it, including security).
300 words, about 2 min04Secure Software Architecture and Design
Secure design happens before code exists, where changes cost least. Know threat modeling as a repeatable process: decompose the system into data flows, processes, data stores, and external entities; draw trust boundaries; identify threats per element; rate them; choose mitigations that become requirements and tests.
296 words, about 1 min05Secure Software Implementation
Implementation questions test whether you can prevent classes of defect rather than recite a vulnerability list. Know CWE as a weakness taxonomy and the OWASP Top 10 as risk awareness categories, and be able to map a coding mistake to its class.
307 words, about 2 min06Secure Software Testing
Secure testing produces evidence that security requirements are met and that defects are found early. Know the vocabulary: verification (built to spec) versus validation (fit for purpose); static testing without execution versus dynamic testing of a running system; white-box versus black-box.
315 words, about 2 min07Secure Software Deployment, Operations, Maintenance
This domain covers getting software into production safely and keeping it healthy. Secure deployment means hardened baselines, configuration management and infrastructure as code under version control, separation of development, test, and production with no production data in lower environments, and controlled release through change management with approval, rollback, and audit trail.
306 words, about 2 min08Secure Software Supply Chain
Supply chain risk covers everything you did not write: open-source components, commercial and COTS software, APIs and cloud services, and the build and distribution infrastructure itself. Attackers target the weakest link - a compromised update, a typosquatted package, or a transitive dependency nobody chose deliberately.
328 words, about 2 min