CISSP Central

8.5 Define and apply secure coding guidelines and standards8.5.1 Security weaknesses and vulnerabilities at the source-code level8.5.2 Security of application programming interfaces (API)8.5.3 Secure Coding Practices8.5.4 Software-defined security

8.3 Assess the effectiveness of software security8.3.1 Auditing and logging of changes8.3.2 Risk analysis and mitigation8.4 Assess security impact of acquired software8.4.1 Commercial-off-the-shelf (COTS)8.4.2 Open Source8.4.3 Third-Party8.4.4 Managed Services (e.g.., enterprise applications)8.4.5 Cloud Services (e.g.., SaaS, IaaS, PaaS)

8.2 Identify & apply security controls in development environments8.2.1 Programming languages8.2.2 Libraries8.2.3 Tool sets8.2.4 Integrated Development Environment (IDE)8.2.5 Runtime8.2.6 Continuous Integration and Continuous Delivery (CI / CD)8.2.7 Software Configuration Management (SCM)8.2.8 Code Repositories8.2.9 Application security testing (e.g., SAST, DAST, IAST & SCA)

8.1 Understand and integrate security in the software development lifecycle8.1.1 Development Methodologies8.1.2 Maturity Models (e.g., Capability Maturity Model (CMM), Software Assurance Maturity Model (SAMM))8.1.3 Operations & Maintenance8.1.4 Change Management8.1.5 Integrated Product Team (IPT)

7.13 Participate in Business Continuity (BC) planning and exercises7.14 Implement and manage physical security7.15 Address personnel safety and security concerns7.15.1 Travel7.15.2 Security Training & Awareness7.15.3 Emergency Management7.15.4 Duress