CISSP CORE CONCEPTS -Domain-8 | The Ultimate CISSP Course

Learn to integrate security into each SDLC phase, with design-based threat modeling and early SAST, DAST, and IAST testing to mitigate risk.

Explore SDLC development methodologies—waterfall, incremental, spiral, rapid application development, and joint application development—focusing on risk assessment, change and configuration management, and maturity models.

Explore software development life cycle methodologies, including clean room, agile, and DevOps, focusing on defect prevention, adaptive planning, cross-functional teams, and rapid feedback loops.

Explore the CMM/CMMi and OWASP SAM maturity models, detailing repeatable and defined levels, with emphasis on process maturity and exam-ready concepts.

Explains operation and maintenance in software development, emphasizing change management, risk assessment, and integrating security practices into CI/CD, including code signing and ongoing vulnerability management.

Discover change management in software development, including the change advisory board, standard and emergency changes, regression testing, RACI responsibilities, and rollback plan.

Explore the integrated product team in CISSP domain 8.1.5, featuring representatives from development, testing, and operations and a veto-driven, democratic process for critical product decisions.

Explore security controls in the development environment for compiled and interpreted languages, including memory corruption and buffer overflow vulnerabilities.

Explore software libraries, including third-party and open source options, and understand software composition analysis, licensing, and runtime application self-protection for mitigating library vulnerabilities.

Explore how IDEs with version control enable secure coding through code reviews and detecting unauthorized changes. Learn why plugins require vetting and reputation checks to prevent security risks.

Understand runtime concepts and security by examining how hardware, software, and OS protect the execution environment, mitigate buffer overflow threats, and apply dynamic testing like DAST and IAST.

Explore continuous integration and continuous delivery (ci/cd) pipelines that automate code integration, testing, and canary testing, with integrated security gates and rollback planning to ensure safe production releases.

Drive software configuration management by prioritizing stability and integrity of the code. Leverage baselines, configuration auditing, and version control as core SCM components.

explores code repositories, version control, and static code analysis, showing how code signing ensures integrity and authenticity, and why handling cryptographic keys and MFA matters for secure collaboration.

Explore SAST, DAST, and IAST within integrated application security testing to holistically assess static, dynamic, and runtime vulnerabilities across applications and mobile apps.

Assess the effectiveness of software security across the software development life cycle through auditing, logging, and risk analysis of the development environment, with independent audits to identify gaps.

Explore software acquisition concepts, including commercial off-the-shelf and open source options, with due diligence, vulnerability management, and architecture review. Learn roles of third-party solutions and quality assurance in secure deployments.

Understand managed services and cloud outsourcing, the shared responsibility model, and security controls across IaaS and PaaS, including WAF, encryption, and bring-your-own-key management.

Explore secure coding guidelines and common vulnerabilities, including SQL injection, cross-site scripting, and cross-site request forgery, and learn mitigations like prepared statements, parameterized queries, input validation, and anti-CSRF tokens.

Examine the security of application programming interfaces (api), including api keys, token-based authentication with jwt or oauth, rate limiting, and the soap versus rest api trade-offs for enterprise security.