Forward or Backwards

Topics › Computers › Information Security

CISSP Domain 8: Software Development Security

Published · 1 h 2 min

Watch on YouTube

A full tour of Domain 8 of the CISSP exam - Software Development Security - worth 10% of the exam under ISC2's exam outline effective 15 April 2024, and the last of the eight domains in this series.

This video opens with the domain's weighting and its five 2024 objectives, then traces where the domain came from: the pre-2015 ten-domain CBK, the 16 April 2015 consolidation to eight domains, and the 2024 outline's shift in weighting. It then works through every sub-domain in turn: security built into every phase of the software development lifecycle (SDLC); how waterfall, agile, DevOps and DevSecOps each place security checks differently, and what 'shifting left' means; maturity models CMM and OWASP SAMM; change management and operations and maintenance; securing the development environment itself - languages, libraries, IDEs, CI/CD pipelines and code repositories; the four complementary testing types, SAST, DAST, IAST and software composition analysis; auditing, logging and risk analysis; acquired software - commercial off-the-shelf, open source, third-party and cloud services under the shared responsibility model (SaaS, PaaS, IaaS); secure coding and both editions of the OWASP Top Ten (2021 and the newer 2025 edition) alongside MITRE's CWE catalogue; the NIST Secure Software Development Framework; API security and software-defined infrastructure (SDN and infrastructure as code); databases - ACID properties, aggregation, inference and polyinstantiation; and malware, with the logic bomb as development security's own insider risk.

It closes with how Domain 8 earns exam marks, the related CSSLP certification, how this domain connects to the other seven in the series, a full recap, and eighteen exam-style questions, each with four options, a pause to think, and an explained answer.

Every figure is on screen with its source and date.

Educational documentary. Not financial or investment advice.

In these topics

Chapters

  1. Welcome, and what this domain weighs
  2. Where this domain came from
  3. What changed in 2024
  4. Security in the SDLC: building it in from the start
  5. SDLC models: waterfall and agile
  6. DevOps, DevSecOps and shifting left
  7. Maturity models: CMM and SAMM
  8. Change management and operations and maintenance
  9. Securing languages, libraries and IDEs
  10. CI/CD pipelines and the build toolchain
  11. Software configuration management and code repositories
  12. Testing your own code: SAST and DAST
  13. IAST and software composition analysis
  14. Assessing software security effectiveness
  15. Trusting code you didn't write: COTS and open source
  16. Third-party and cloud services: SaaS, IaaS, PaaS
  17. Secure coding and the OWASP Top 10, part one
  18. The OWASP Top 10, part two, and the CWE catalogue
  19. Secure coding standards and guidelines
  20. API security and software-defined infrastructure
  21. Databases: ACID, aggregation, inference & polyinstantiation
  22. Malware and the software supply chain
  23. How this domain earns exam marks, and CSSLP
  24. The series, looked at as a whole
  25. Domain 8 full recap
  26. Review questions, part one
  27. Review questions, part two
  28. Review questions, part three

More from Forward or Backwards on YouTube

Sources and credits

Primary sources

  • ISC2, 'CISSP Certification Exam Outline', effective 15 April 2024 (isc2.org) - Domain 8 weighted 10% (down from 11%), Domain 1 up to 16%, five objectives (8.1-8.5).
  • ISC2 press materials and the Training Camp press release 'CISSP Eight-Domain CBK Update' on the 16 April 2015 consolidation of the CBK from ten domains to eight; Software Development Security is one of the originals and kept its name through the consolidation.
  • OWASP Foundation, 'OWASP Top 10:2021' (owasp.org) - ten named categories, A01 Broken Access Control through A10 Server-Side Request Forgery.
  • OWASP Foundation, 'OWASP Top 10:2025' (top10.owasp.org/2025) - fetched directly 11 October 2026. Ten named categories, two new (Software Supply Chain Failures, Mishandling of Exceptional Conditions); release candidate announced 6 November 2025, finalised January 2026 per corroborating secondary reports (SD Times, cybersecuritynews.com).
  • NIST Special Publication 800-218, 'Secure Software Development Framework (SSDF) Version 1.1' - four practice groups (Prepare the Organization, Protect the Software, Produce Well-Secured Software, Respond to Vulnerabilities), 42 tasks. Re-checked by web search 11 October 2026.
  • OWASP SAMM Project, 'SAMM v2' release notes (owaspsamm.org) - five business functions: Governance, Design, Implementation, Verification, Operations. Re-checked by web search 11 October 2026.
  • ISC2, 'CSSLP - Certified Secure Software Lifecycle Professional' programme material, re-checked via secondary training-provider summaries (InfoSec Institute, Global Knowledge) 11 October 2026: eight domains, four years' combined SDLC experience required in at least one. Per-domain weighting not narrated - sourced only secondhand.
  • ISC2, 'CISSP Certification Exam Outline' (2024) - exam format: Computerized Adaptive Testing, 100-150 questions, 3-hour limit, pass mark 700/1000.

Not regulated financial advice.