Study Hub / ISC2 CISSP (CISSP) / Domain 8.0
CISSP Domain 8.0: Software Development Security — Explained
Domain 8.0 puts security into how software gets built: the development lifecycle, the vulnerability classes that haunt web apps, and the testing that catches them before attackers do. Concept-heavy and very approachable.
Secure SDLC: shifting left
- Waterfall vs. agile vs. DevOps — waterfall plans everything upfront (security reviews at gates); agile iterates in sprints (security must fit each sprint); DevOps automates the pipeline (security becomes automated gates in the pipeline — DevSecOps).
- Shift left — moving security earlier in the lifecycle: threat modeling in design is 100x cheaper than patching in production. The exam's mantra: the earlier the finding, the cheaper the fix.
- Threat modeling — design-phase analysis: what are we building, what can go wrong, what do we do about it? STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, DoS, Elevation of privilege) is the classic framework.
- Security requirements — functional requirements say what the software does; security requirements say what it must never allow. Both belong in the spec, not as afterthoughts.
The vulnerability hall of fame (OWASP concepts)
- Injection — untrusted input executed as code: SQL injection being the classic. The fix is never string concatenation — parameterized queries / prepared statements.
- Broken access control — users reaching functions or data beyond their permissions: insecure direct object references, missing authorization checks. OWASP's #1 for years.
- Cryptographic failures — weak algorithms, hardcoded keys, sensitive data in plaintext. Not "we forgot crypto" but "we did crypto wrong."
- Cross-site scripting (XSS) — attacker script runs in victims' browsers: steal sessions, deface, phish. Stored (in the database, hits everyone), reflected (in a crafted link), DOM-based (in client-side code).
- Security misconfiguration — default credentials, verbose errors, unnecessary services. The "we deployed the sample config" vulnerability.
- Vulnerable components — the library you didn't write has the CVE you didn't check. Software bills of materials (SBOMs) track what you're actually running.
Testing: proving it before attackers do
- SAST (static) — analyzes source code without running it. Early, fast, finds coding flaws; can't see runtime behavior.
- DAST (dynamic) — tests the running application from outside, like an attacker. Finds what SAST misses; later in the cycle.
- IAST / SCA — interactive testing (instrumented runtime) and software composition analysis (scanning third-party libraries for known CVEs).
- Code review — humans reading code for logic flaws automation can't see. Slow, expensive, irreplaceable for critical paths.
- DevSecOps pipeline — SAST on commit, SCA on build, DAST on deploy, plus secrets scanning (no credentials in repos) and signed artifacts. Security as automation, not meetings.
The must-memorize table: testing methods
Which test finds what, when.
| Method | Tests | When / notes |
|---|---|---|
| SAST | Source code, not running | Early (on commit); finds coding flaws |
| DAST | Running app, from outside | Later (staging); finds runtime issues |
| SCA | Third-party libraries | On build; matches against CVE databases |
| Manual code review | Logic, by humans | Critical code paths; finds what tools miss |
| Penetration test | Whole system, adversarially | Pre-release; proves exploitability |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A developer builds database queries by concatenating user input directly into SQL strings. What vulnerability is this, and what is the fix?
- A. A. XSS — encode all output
- B. B. SQL injection — use parameterized queries / prepared statements
- C. C. CSRF — add anti-forgery tokens
- D. D. Buffer overflow — check array bounds
Show answer & reasoning
B. Concatenated input executed as SQL is the textbook SQL injection pattern. The fix is structural: parameterized queries separate code from data so input can never become instructions. Output encoding (A) fixes XSS, a different bug in a different place.
2. A security team wants to find vulnerabilities in a running staging application, testing it the way an attacker would. Which method fits?
- A. A. SAST — analyze the source code
- B. B. DAST — dynamic testing of the running app from outside
- C. C. A code style linter
- D. D. Unit tests written by developers
Show answer & reasoning
B. Running app + external attacker perspective = DAST. SAST (A) needs source code and doesn't see runtime behavior; linters (C) check style, not security; unit tests (D) verify intended behavior, not resistance to malicious input.
3. An audit finds the production web server still uses the vendor's default admin password. Which OWASP category is this?
- A. A. Injection
- B. B. Cryptographic failures
- C. C. Security misconfiguration
- D. D. Broken access control
Show answer & reasoning
C. Default credentials are the poster child of security misconfiguration: the software is fine, the deployment is negligent. It's not an injection flaw (A) or a crypto failure (B) — it's "we never finished setting it up." Misconfiguration is consistently a top-10 finding because it's so common.
4. Why does the CISSP emphasize finding vulnerabilities during design rather than after deployment?
- A. A. Design-phase tools are more accurate
- B. B. Fixing earlier is dramatically cheaper — "shift left"
- C. C. Deployed systems can't be patched
- D. D. Attackers only target design documents
Show answer & reasoning
B. The cost curve is brutal: a flaw caught in design costs a conversation; the same flaw in production costs emergency patches, downtime, and possibly breach notification. "Shift left" is the economic argument for threat modeling and secure design — spend a little early to avoid spending a fortune late.
This was one domain. The simulator drills all 8.
This free preview covered Software Development Security (Domain 8.0, 10%). Not covered here: Communication & Network Security (Domain 4.0, 13%); Security Assessment & Testing (Domain 6.0, 12%); Security Operations (Domain 7.0, 13%). The three most operational domains — network security, assessment, and security operations — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full CISSP Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy