Certified Secure Software Lifecycle Professional (CSSLP)

Als CSSLP beschikt u over een holistisch begrip van security best practices, policies en procedures gedurende alle fases van de software ontwikkel levenscyclus. U ontwikkelt veilige applicaties die weerbaar zijn tegen aanvallen en beantwoorden aan alle eisen op het gebied van compliance, kwaliteit, functionaliteit en assurance. Daarmee kunt u uiteraard ook anderen adviseren in het ontwikkelen van veilige software.

De Certified Secure Software Lifecycle Professional (CSSLP) training is bestemd voor iedereen die betrokken is bij de SDLC met minstens 4 jaar full-time werkervaring in 1 of meer van de 8 domeinen van de CSSLP CBK. CSSLPs houden vaak posities, zoals de volgende:

• Software Architect
• Software Engineer
• Software Developer
• Application Security Specialist
• Software Program Manager
• Quality Assurance Tester
• Penetration Tester
• Software Procurement Analyst
• Project Manager
• Security Manager
• IT Director/Manager

Deze training omvat de acht CSSLP domeinen:

1. Secure Software Concepts

• Understand core concepts
• Understand security design principles

2. Secure Software Lifecycle Management

• Manage security within a software development methodology (e.g., Agile, waterfall)
• Identify and adopt security standards (e.g., implementing security frameworks, promoting security awareness)
• Outline strategy and roadmap
• Define and develop security documentation
• Define security metrics (e.g., criticality level, average remediation time, complexity, Key Performance Indicators (KPI), objectives and key results)
• Decommission applications
• Create security reporting mechanisms (e.g., reports, dashboards, feedback loops)
• Incorporate integrated risk management methods
• Implement secure operation practices

3. Secure Software Requirements

• Define software security requirements
• Identify Compliance Requirements
• Identify Data Classification Requirements
• Identify Privacy Requirements
• Define data access provisioning
• Develop misuse and abuse cases
• Develop Security Requirement Traceability Matrix (STRM)
• Define third-party vendor security requirements

4. Secure Software Architecture and Design

• Define the security architecture
• Perform secure interface design
• Evaluate and select reusable technologies
• Perform threat modeling
• Perform architectural risk assessment and design reviews
• Model (non-functional) security properties and constraints
• Define secure operational architecture (e.g., deployment topology, operational interfaces, Continuous Integration and Continuous Delivery (CI/CD))

5. Secure Software Implementation

• Adhere to Relevant Secure Coding Practices (e.g., standards, guidelines and regulations)
• Analyze Code for Security Risks
• Implement Security Controls (e.g., watchdogs, File Integrity Monitoring (FIM), anti-malware)
• Address the identified security risks (e.g., risk strategy)
• Evaluate and integrate components
• Apply security during the build process

6. Secure Software Testing

• Develop security testing strategy & plan
• Develop Security Test Cases
• Verify and Validate Documentation (e.g., installation and setup instructions, error messages, user guides, release notes)
• Identify Undocumented Functionality
• Analyze Security Implications of Test Results (e.g., impact on product management, prioritization, break/build criteria)
• Classify and Track Security Errors
• Secure Test Data
• Perform verification and validation testing (e.g., independent/internal verification and validation, acceptance test)

7. Secure Software Deployment, Operations, and Maintenance

• Perform Operational Risk Analysis
• Secure Configuration and version control
• Release Software Securely
• Store and Manage security data
• Ensure Secure Installation
• Obtain Security Approval to Operate (e.g., risk acceptance, sign-off at appropriate level)
• Perform Information Security Continuous Monitoring (ISCM)
• Execute the incident response plan
• Perform Patch Management (e.g. secure release, testing)
• Perform vulnerability management (e.g., tracking, triaging, Common Vulnerabilities and Exposures (CVE))
• Incorporate runtime protection (e.g., Runtime Application Self Protection (RASP), web application firewall (WAF), Address Space Layout Randomization (ASLR), dynamic execution prevention)
• Support Continuity of Operations
• Integrate service level objectives and service-level agreements (SLA) (e.g., maintenance, performance, availability, qualified personnel)

8. Secure Software Supply Chain

• Implement software supply chain risk management (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST))
• Analyze Security of Third-Party Software
• Verify Pedigree and Provenance
• Ensure and verify supplier security requirements in the acquisition process
• Support contractual requirements (e.g., intellectual property ownership, code escrow, liability, warranty, End-User License Agreement (EULA), service-level agreements (SLA))