Securing software for the CISSP isn't about finding a culprit after the crime. It's about establishing chain of custody from the very first piece of evidence. You aren't just auditing a final product; you are proving the integrity of the entire process that created it.
To pass CISSP Domain 8, you must demonstrate judgment on integrating security throughout the Software Development Lifecycle (SDLC). This means applying "security by design" principles to methodologies like Agile and DevSecOps, using maturity models like SAMM for improvement, and automating controls in CI/CD pipelines.
Key facts
- Official Body
- ISC2
- Exam Format
- Computer Adaptive Testing (CAT) for English exams
- Passing Score
- 700 out of 1000 scaled points
- Total Questions
- 125-175 (CAT)
- Exam Duration
- Up to 4 hours (CAT)
- Domain 8 Weight
- 11% of the exam, per the ISC2 CISSP Exam Outline effective April 15, 2024.
Why SDLC Security is a Judgment Test, Not a Memory Test
CISSP Domain 8, "Software Development Security," trips up candidates who just memorize acronyms. The examiner wants to know if you can apply security principles within the constraints of a specific development model. Can you advise a team using Waterfall differently than one using DevSecOps? That is the core skill.
The two mental models you must internalize are "Shift Left" and "Security by Design."
Studying for CISSP? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Mastering this domain is about understanding these philosophies, not just listing tools. To test your current judgment, you can try VoraPrep's free CISSP practice questions and see how you fare on scenario-based challenges.
How to Integrate Security into Waterfall, Agile, and DevSecOps
The CISSP expects you to know how security adapts to the speed and structure of different development methodologies.
Waterfall
The Waterfall model is linear and sequential. Each phase (Requirements, Design, Implementation, Testing, Deployment) must be completed before the next begins.Its rigidity is a security weakness. Security is often relegated to a final testing phase, where fixing flaws is expensive and time-consuming. Your role here is to force security "gates" between phases: conduct security requirements analysis, perform architectural risk analysis in the design phase, and mandate code reviews before testing.
Agile
Agile development is iterative, with work done in short cycles called sprints. This requires a different security mindset.Security can't be a separate phase; it must be part of every sprint. This means writing security-focused user stories, performing threat modeling for new features during sprint planning, and integrating automated security testing into the definition of "done" for each sprint.
DevSecOps
DevSecOps is the gold standard for the exam. It extends DevOps by embedding security automation and responsibility throughout the entire development and operations pipeline.This is the ultimate expression of "Shift Left." Security is a shared responsibility, and the goal is to automate as much as possible within the Continuous Integration/Continuous Delivery (CI/CD) pipeline. This includes automated code scanning, dependency analysis, and security configuration checks.
Choosing the Right Maturity Model: CMMI vs. SAMM vs. BSIMM
Maturity models are frameworks for measuring and improving an organization's software security practices. You must know the difference.
- CMMI (Capability Maturity Model Integration): Focuses on general process improvement for software development. It is not a security model, but a high CMMI level implies disciplined processes that make security easier to implement.
- SAMM (Software Assurance Maturity Model): An OWASP project, SAMM is a prescriptive model. It provides a roadmap for organizations to build a software security program, assess their current posture, and create a plan for improvement. Think of it as a "how-to" guide.
- BSIMM (Building Security In Maturity Model): This is a descriptive model. It's a study of what real-world organizations are actually doing for software security. It provides data and benchmarks, allowing you to compare your practices against others. Think of it as a "what are they doing" report.
| Model | Primary Focus | Type | Key Takeaway for CISSP |
|---|---|---|---|
| CMMI | Process Improvement | General | Not security-specific, but enables security. |
| SAMM | Software Security | Prescriptive | A recipe for building a security program. |
| BSIMM | Software Security | Descriptive | A survey of what other companies are doing. |
Calculate Your CISSP Score & Study Hours by Domain
Adjust your practice scores across official CISSP blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
Securing the CI/CD Pipeline: From Code to Cloud
The CI/CD pipeline automates how code gets from a developer's machine to production. Securing it is non-negotiable. The exam will test your knowledge of where to place specific controls.
Key Pipeline Security Controls
- Threat Modeling: Before code is written, use frameworks like STRIDE to identify potential threats to a new feature.
- SAST (Static Application Security Testing): Integrated into the "commit" or "build" stage. It scans raw source code for vulnerabilities like SQL injection or buffer overflows. This is your earliest automated check.
- SCA (Software Composition Analysis): Also in the "build" stage. It scans for known vulnerabilities in third-party libraries and open-source components, a huge part of modern software supply chain risk.
- DAST (Dynamic Application Security Testing): Used in the "test" stage on a running application. It acts like a hacker, probing the application for vulnerabilities from the outside.
- Secrets Management: Integrate tools to prevent developers from hardcoding passwords, API keys, or other secrets in the source code.
- Container Security: Scan container images for vulnerabilities before they are pushed to a registry or deployed.
Worked Example: A Classic DevSecOps Judgment Call
You see this scenario on your exam. How do you break it down?
Scenario: A financial services company is moving to a DevSecOps model to accelerate the deployment of its mobile banking app. The security team's current process involves a manual penetration test one week before each quarterly release. Question: Which action provides the greatest security improvement in the new DevSecOps context?Thinking Through the Problem
- Identify the keywords: The critical context is "DevSecOps" and "greatest security improvement." This points toward automation, speed, and shifting left. The current process (late-stage manual pen testing) is the opposite of DevSecOps.
- Analyze Option A: This is just doing the wrong thing more often. It's still a late, manual process that will slow down a rapid deployment pipeline. It's a poor fit for DevSecOps.
- Analyze Option B: Training is good. It's a foundational "people" control. However, it doesn't directly integrate a control into the pipeline itself. It's important but likely not the greatest improvement compared to an automated technical control.
- Analyze Option C: This is the textbook "shift left" action. It's automated, happens at the earliest possible moment (code commit), and provides immediate feedback to developers. It directly addresses the need for continuous, integrated security within the pipeline.
- Analyze Option D: Security champions are an excellent way to scale security expertise and improve culture. This is a very strong option and a key part of a mature DevSecOps program. However, compared to implementing a foundational automated tool (SAST), it's a longer-term cultural initiative. The SAST tool provides an immediate, tangible, and automated control across all code.
The Fastest Reliable Way to the Answer
The question asks for the greatest improvement in a DevSecOps context. You must pick the answer that best embodies automation and early detection. SAST upon commit (Option C) is the purest example of this principle.The most tempting wrong answer is D. A security champions program is a fantastic idea. But for the CISSP, a direct, automated, technical control integrated into the pipeline (SAST) is often considered a more immediate and impactful initial improvement than a cultural program. The question is about the greatest improvement, and automated scanning provides a baseline of security that scales instantly.
How to Master SDLC Security This Week: A 7-Day Sprint
Use this plan to go from uncertain to confident in Domain 8.
Day 1: Solidify the Philosophies
Forget acronyms. Spend today just on "Shift Left" and "Security by Design." Write down in your own words what they mean. Find one example of each. Review the core differences between Waterfall, Agile, and DevSecOps, focusing on how they impact security timing.Day 2: Differentiate the Maturity Models
Create your own version of the CMMI vs. SAMM vs. BSIMM table. Use flashcards to drill the difference between prescriptive (SAMM) and descriptive (BSIMM). This distinction is a frequent exam topic.Day 3: Map the CI/CD Pipeline
Draw a simple CI/CD pipeline: Commit → Build → Test → Deploy. Now, place the key security controls on it: SAST, SCA, DAST, Secrets Scanning, Container Scanning. Explain to yourself why each tool belongs in that specific stage.Day 4: Threat Modeling and Secure Coding
Dive into STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). Practice applying it to a simple feature, like a login page. Then, review the current OWASP Top 10 list of web application vulnerabilities.Day 5: Practice Question Blitz
Take 30-40 practice questions focused only on Domain 8. Use a platform like VoraPrep, where the CISSP practice questions come with detailed rationales that explain why the wrong answers are wrong. This is where the real learning happens.Day 6: Analyze Your Mistakes
Review every question you got wrong yesterday. Was it because you misunderstood a concept (e.g., SAST vs. DAST)? Or was it a judgment error (e.g., picking a manual process over an automated one)? If you're stuck, ask Vory, your 24/7 personal tutor on VoraPrep, to walk you through the logic.Day 7: Timed Mini-Exam
Take a 25-question quiz covering all of Domain 8. Give yourself a time limit. This simulates the pressure of the real exam and forces you to apply your knowledge quickly and accurately. Review your results to find any final weak spots. For more details on the exam format, check out our CISSP exam information page.Ready to Pass Your CISSP Exam? VoraPrep offers a complete 6-pillar interactive course built to teach you how to think like the examiner. Our platform includes textbook-grade lessons, an adaptive practice bank with over 2,200 questions, 1:1 exam simulators, and Vory, your 24/7 personal tutor.
Visit voraprep.com to get started.
Start Your Free 14-Day Trial at voraprep.com →