From the course: ISC2 Certified Secure Software Lifecycle Professional (CSSLP) (2023) Cert Prep

Secure software concepts

From the course: ISC2 Certified Secure Software Lifecycle Professional (CSSLP) (2023) Cert Prep

Start my 1-month free trial Buy for my team

Secure software concepts

“

- [Narrator] The first domain of the CSSLP body of knowledge is secure software concepts. This domain focuses on certain fundamental security principles, and it lays the foundation for how you can begin to apply those principles to the SDLC. This domain accounts for 12% of the CSSLP exam. Core concepts is the first focus area for this domain. You'll learn about security fundamentals, like confidentiality, integrity, and availability, principles that are foundational to every CSSLP domain. And since the CSSLP focuses on software security, you'll also learn about the concepts of authentication and authorization, as well as accountability and non-repudiation. The second focus area for this domain is security design principles. You'll learn about access controls, like the principle of least privilege and separation of duties, and you'll learn about balancing resiliency controls with the idea of economy of mechanism. You'll also learn how to layer your application security controls by incorporating ideas such as defense in depth and diversity of defense. You'll continue exploring that security balancing act as you learn about component reuse and least common mechanism, and how these ideas fit into a larger defense in depth strategy. This domain also covers two concepts that, at first, may seem counterintuitive to software security, namely open design and psychological acceptability.

Contents