Certified Secure Software Lifecycle Professional (CSSLP) Training

CSSLP Course Outline

• Secure Software Concepts

  • Core concepts
  • Security design principles

• Secure Software Requirements

  • Identify security requirements
  • Interpret data classification requirements
  • Identify privacy requirements

• Secure Software Design

  • Perform threat modeling
  • Define the security architecture
  • Model (non-functional) security properties and constraints
  • Evaluate and select reusable secure design
  • Use security enhancing architecture and design tools
  • Use secure design principles and patterns

• Secure Software Implementation/Programming

  • Follow secure coding practices
  • Analyze code for security vulnerabilities
  • Implement security controls
  • Fix security vulnerabilities
  • Look for malicious code
  • Securely reuse third party code or libraries
  • Securely integrate components
  • Apply security during the build process
  • Debug security errors

• Secure Software Testing

  • Develop security test cases
  • Develop security testing strategy and plan
  • Identify undocumented functionality
  • Interpret security implications of test results
  • Classify and track security errors
  • Secure test data
  • Develop or obtain security test data
  • Perform verification and validation testing (e.g., IV&V)

• Software Lifecycle Management

  • Secure configuration and version control
  • Establish security milestones
  • Choose a secure software methodology
  • Identify security standards and frameworks
  • Create security documentation
  • Develop security metrics
  • Decommission software
  • Report security status
  • Support governance, risk and compliance (GRC)

• Software Deployment, Operations and Maintenance

  • Perform implementation risk analysis
  • Release software securely
  • Securely store and manage security data
  • Ensure secure installation
  • Perform post-deployment security testing
  • Obtain security approval to operate
  • Perform security monitoring (e.g., managing error logs, audits, meeting SLAs, CIA metrics)
  • Support incident response
  • Support patch and vulnerability management
  • Support continuity of operations

• Supply Chain and Software Acquisition

  • Analyze security of third party software
  • Verify pedigree and provenance
  • Provide security support to the acquisition process