CSSLP Course | Certified Secure Software Lifecycle Professional Training- Vinsys

Select Language

Select Country

ENQUIRE NOW

training

Domain / Vendor

certified secure software lifecycle professional csslp certification

Focused training on ISC2 CSSLP CBK

Pre-and post-assessment questions

After-course follow-ups

Tracking and reporting assistance

Overview Learning Objectives Who Should Attend Prerequisite Outline

CSSLP Course Overview

CCSLP certification is a 05-days (40-hour) course that aims at application security within the SDLC. The course training is intended to help learners validate their experience in application security and demonstrate working knowledge of it. CCSLP course modules are designed to achieve knowledge of security data and develop post-deployment security testing. The software supply chain risks will enable learners to evaluate the security of third-party software. With the course knowledge, you can acquire process and support for contractual requirements.

The course training discusses third-party code and libraries, software composition analysis, and the security of the build process for the learners. Validation and verification, security test results, and tracking security errors knowledge can help you deploy security-relevant maintenance activities and discuss planning for the continuity of operations.

Course Objectives

Software security and construction of resilient software
Security design principles for building secure software
Software security standards and frameworks, roadmaps and strategies, and risk management
Security in software development methodologies
Security metrics and security culture in software development
Software requirements pertaining to data privacy, security, and compliance with laws and regulations
Specification and tractability, misuse and abuse cases, and flow down of security requirements

Audience

Project Manager
Quality Assurance Tester
IT security professional (Director)
Software Program Manager
Penetration Tester
Software Procurement Analyst
System and Network Administrators
System Auditors
Application Programmers
Security Manager
Software Architect
Software Developer
Application Security Specialist

Eligibility Criteria

To obtain quality CCSLP certification, you need to have the following:

04-years of full-time work experience with secure software lifecycle professional in one or more of the eight domains of the (ISC)2 CCSLP Common Body Knowledge.
- Domain 1. Secure Software Concepts
- Domain 2. Secure Software Requirements
- Domain 3. Secure Software Architecture and Design
- Domain 4. Secure Software Implementation
- Domain 5. Secure Software Testing
- Domain 6. Secure Software Lifecycle Management
- Domain 7. Secure Software Deployment, Operations, Maintenance
- Domain 8. Secure Software Supply Chain
03-years of direct full-time experience with secure software lifecycle pro

Course Outline

Module 1: Secure Software Concepts Domain

Define core security objectives for software development.
Describe the information security triad and explain the main mechanisms of confidentiality, integrity, and availability of information.
Characterize the relationship between information security and data privacy.
Describe accountability, auditing, and logging in the context of software security.
Explain non-repudiation, digital signatures, the benefits of code signing, and blockchain.
Understand the foundational concepts behind security design principles with respect to secure software development.

Module 2: Secure Software Lifecycle and Risk Management Domain

Understand and describe OWASP's Software Assurance Maturity Model (OpenSAMM) and Building Security in Maturity Model (BSIMM).
Define and recognize security configuration standards and benchmarks.
Understand and describe security-focused configuration management processes.
Recognize security milestones.
Explain and illustrate the incorporation of software security practices into the SDLC processes.
Discuss security in predictive and adaptive planning for software development.
Describe DevOps and DevSecOps.
Describe System Security Plan.
Recognize security-relevant documentation.
Evaluate metrics in software development.
Recognize attack surface evaluation for measuring security in software.
Describe software decommissioning, end-of-life policy, and processes.
Discuss data disposition.
Explain information system continuous monitoring (ISCM).
Describe security information event management (SIEM).
Recognize risk management terminology and describe the risk management process.
Explain regulations and legal aspects pertaining to intellectual properties and security breaches.
Discuss architectural risk assessment.
Describe operational risks relevant to the integration and deployment environment.
Recognize the importance of personnel training.
Describe security champions and discuss the importance of security education and guidance.
Explain retrospectives and continuous improvement in Agile development environments.
Discuss lessons learned with respect to the processes used to build software.

Module 3: Secure Software Requirements Domain

Discuss requirements management and identify sources for software security requirements.
Recognize functional and non-functional requirements and explain the importance of security-focused stories in SCRUM/SCRUM-like methodologies.
Analyze misuse/abuse cases and recognize their relevance to known attack patterns.
Describe Security Requirements Traceability Matrix (STRM) and discuss how security requirements flow down to suppliers/providers.
Analyze security policies and their supporting elements as internal sources for security requirements.
Explain compliance requirements and recognize laws, regulations, and industry standards as external sources for security requirements.
Discuss security standards and frameworks.
Describe data governance, explain data ownership, and recognize relevant roles and responsibilities.
Describe data classification and explain security labeling and marking.
Recognize data types, structured and unstructured.
Describe the data lifecycle and explain the process for secure data retention and destruction.
Discuss privacy risks, recognize privacy laws and regulations, and explain the requirements for safeguarding personal information.
Discuss data anonymization and enumerate various approaches for anonymization.
Explain user consent, data retention, and data disposition in the context of privacy.
Recognize implications of cross-border data transfer and restrictions for the transfer of personal data.

Module 4: Secure Software Architecture and Design Domain

Understand common threats; describe the threat modeling process, tools, and methodologies and explain the process of attack surface evaluation and management.
Discuss threat intelligence and describe the sources for cyber threat information.
Discuss the process of identification and prioritization of security controls and describe security properties and constraints on the design and constraints imposed by the deployment environment.
Describe various architectures and discuss their security-relevant aspects.
Describe pervasive computing and IoT, discuss various contactless technologies and discuss their security and privacy aspects.
Explain embedded software and discuss the update challenge and discuss Field-Programmable Gate Array (FPGA) and microcontroller security.
Explain cloud computing, service models, and deployment models, and describe the shared security responsibility model. Discuss mobile application security.
Discuss hardware platform concerns, side channel mitigation, speculative execution mitigation, and Hardware Security Modules (HSM).
Explain cognitive computing, machine learning, and artificial intelligence.
Discuss control systems and their applications in various areas and safety criticality aspects.
Evaluate security criteria of interfaces, out-of-band management, and log interfaces.
Understand upstream and downstream dependencies, protocol design choices, and their security ramifications.
Describe various authentication and authorization mechanisms; explain credential management and the digital certificate standard.
Discuss flow controls and data loss prevention; compare and contrast virtual machines and containers.
Explain the trusted computing base (TCB) and the trusted platform module (TPM).
Discuss database security, programming language environment, and operating system controls and services.
Discuss secure architecture and secure design principles, and explain secure design patterns.
Explain verification of the design, formal and informal secure code reviews, and the code inspection process.

Module 5: Secure Software Implementation Domain

Explain the need for establishing and enforcing secure coding standards.
Describe different approaches for implementing security in managed applications.
Describe common flaws in software and corresponding mitigation strategies.
Discuss input validation, output encoding, authentication, session management, access control, cryptographic practices, error and exception management practices, and logging.
Explain type safety, memory management, and isolation
Discuss cryptography, applications to transit and storage, cryptographic agility, cryptographic libraries, and encryption algorithm selection.
Explain access control, trust zones, and function permissions.
Explain vulnerability databases and lists.
Discuss Common Vulnerabilities and Exposures (CVE), Common Weakness Enumerations (CWE), and Common Attack Pattern Enumeration and Classification (CAPEC).
Enumerate OWASP Top 10 Web Application Security Risks.
Describe the categorization of controls by type and by function.
Describe controls to prevent common web application vulnerabilities
Describe OWASP Proactive Controls and critical focus areas around building secure software.
Evaluate the risks associated with using third-party and open-source components and libraries.
Describe Software Composition Analysis (SCA) and open source management.
Discuss OWASP Dependency Check and Dependency Track.
Discuss API integration and evaluate the security aspects.
Describe system-of-systems.
Describe the build process, version control, and safeguards used to ensure integrity.
Discuss anti-tampering techniques as part of software assurance.
Explain the relation of compiler switches and warnings to the enhancement of security.

Module 6: Secure Software Testing Domain

Explain functional and non-functional security testing, its purpose and the phases in penetration testing fuzzing, and its variations and limitations.
Explain vulnerability scanning and content scanning.
Discuss simulation, understand configuration drifts in development environments and describe real user monitoring and synthetic monitoring.
Describe fault injection, stress testing, and break testing.
Describe various types of functional testing, including unit testing, integration testing, and regression testing.
Describe various types of non-functional testing, including scalability, interoperability, and performance testing.
Describe cryptographic validation and explain Pseudo-Random Number Generators and entropy.
Explain test strategy and describe functional and non-functional testing.
Explain the relationship between use cases and misuse and abuse cases and the importance of creating misuse and abuse cases.
Explain test strategy and describe functional and non-functional testing.
Describe test cases and test harnesses.
Explain black-box and white-box testing, objectives, and code coverage.
Discuss application security testing (AST) methods and explain their benefits and limitations.
Discuss manual code reviews and describe searching for embedded malicious code.
Recognize software security-relevant standards, explain crowdsourcing benefits and concerns and discuss bug bounty.
Explain the security implications of test results on product management and prioritization of remediation efforts.
Explain break-build criteria.
Describe the process of tracking security defects.
Explain risk scoring and the Common Vulnerability Scoring System (CVSS).
Explain the generation of test data, security of test data, ramifications of using production data in the test environment, and database referential integrity and constraints.
Describe the process of verification and validation testing and explain acceptance testing.
List various software documentation and explain undocumented functionality.
Describe OWASP's Application Security Verification Standard (ASVS), its structure, and its goals.

Module 7: Secure Software Deployment, Operations, and Maintenance Domain

Explain secure integration, build, and deployment.
Describe the secure software toolchain.
Describe build artifacts and discuss the mobile application and platform security.
Describe security data, including credentials, keys, and certificates, and discuss the ramifications of failing to protect them in production.
Describe vaults used to manage secrets and discuss key vault considerations.
Describe the secure bootstrapping process, hardening, and the least privilege principle with respect to secure software installation.
Explain secure software activation methods and security policy implementation with respect to secure software installation.
Describe the Authorization to Operate (ATO) process and the steps involved.
Explain risk acceptance.
Explain post-deployment verification, issue tracking, and testing constraints.
Describe security testing automation.
Describe the benefits of information security continuous monitoring (ISCM) and list some considerations for its implementation.
Describe events, logs, and threat intelligence.
Explain computer security incidents, incident response, and forensics.
Describe incident precursors and indicators, monitoring logs and alerts, and root-cause analysis.
Describe security patch management and explain the timing, prioritization, and testing aspects of security patches.
Describe vulnerability management and vulnerability scan tools.
Explain the operations of web application firewalls.
Explain the locality of reference, address space layout randomization, and data execution prevention.
Explain continuity of operations, business impact analysis, data backup and restore, and data archiving.
Discuss disaster recovery (DR), data residency requirement aspect of DR, resiliency, and erasure code.

Module 8: Secure Software Supply Chain Domain

Describe the software supply chain.
Recognize participants in the supply chain.
Explain software supply chain risk management.
Explain security risks associated with third-party/open-source code and recognize OWASP's Software Component Verification Standard (SCVS).
Describe software supply chain attacks.
Explain the risks associated with peer-to-peer applications and file sharing.
Explain code repository and build environment security.
Explain cryptographically hashed, digitally signed components.
Describe security in the acquisition process and audit of security policy compliance.
Explain third-party vulnerability/incident notification and reporting and maintenance and support structure.
Explain commercial and open-source software licenses.
Explain vendor/supplier security track record in acquisition and the right-to-audit clause in contracts.
Explain contractual requirements for intellectual property (IP) ownership input sourcing relationships, code escrow, liability, warranty, and service-level agreements (SLAs)

Module 9: Applied Scenario Activities

Applied Scenario Activities

Choose Your Preferred Mode

ONLINE TRAINING

5 days Instructor-led Online Training
Experienced Subject Matter Experts
Approved and Quality Ensured training Material
24*7 learner assistance and support

Enroll Now

CORPORATE TRAINING

Blended Learning Delivery Model (Self-Paced E-Learning And/Or Instructor-Led Options)
Course, Category, And All-Access Pricing
Enterprise-Class Learning Management System (LMS)
Enhanced Reporting For Individuals And Teams
24x7 Teaching Assistance And Support

Enroll Now

FAQ’s

Do Vinsys offer career/course guidance?

Yes, unique guidance with required material is provided to enrolled learners.

What is the course duration?

The course duration is five days (40 hours).

What is the number of questions included in the exam?

The exam will comprise 125 multiple-choice questions.

Why choose Vinsys for this CSSLP course?

We aim to provide high-quality education to learners helping them crack their certification tests in a single attempt

The language medium for the exam is?

CCSLP certification is conducted in English, German, Chinese, Spanish, Korean, and Japanese

Does the course include lab sessions?

Yes, lab sessions are included in the course.

Can I cancel the course after paying the course fees?

Yes, you can cancel the course and get the refund only when cancellation is made 48 hours before the start of the course.

Can I pay from a website?

Can I pay from a website?

What are the domains that CSSLP certification focuses on?

The course focuses on eight domains of the (ISC)2 CCSLP Common Body Knowledge:
•   Domain 1. Secure Software Concepts
•   Domain 2. Secure Software Requirements
•   Domain 3. Secure Software Architecture and Design
•   Domain 4. Secure Software Implementation
•   Domain 5. Secure Software Testing
•   Domain 6. Secure Software Lifecycle Management
•   Domain 7. Secure Software Deployment, Operations, Maintenance
•   Domain 8. Secure Software Supply Chain