CISSP Domain 8 study guide
What Software Development Security tests
Domain 8 integrates security into software from requirements through retirement. The durable answer is usually an early, repeatable engineering control—not a late manual test after risky design decisions are fixed in place.
Domain 8 objectives
Use these official objective areas as a coverage checklist, then combine them in scenario practice.
Security in the SDLC
Integrate security into development methodologies, maturity models, change control, DevOps, and application management.
Development ecosystem controls
Protect repositories, pipelines, environments, libraries, tools, credentials, and configuration.
Software security assessment
Use testing, code analysis, threat modeling, penetration testing, and acceptance criteria.
Acquired software
Assess commercial, open-source, outsourced, managed, and cloud software risks.
Secure coding
Apply standards that prevent common weaknesses and support safe error handling, APIs, memory use, and input processing.
High-yield distinctions
SAST
Finds weaknesses by analyzing code or binaries without running the application.
DAST
Tests an executing application through exposed interfaces.
IAST
Combines runtime instrumentation with active application testing.
RASP
Runs with the application to detect or block attacks during execution.
SCA
Inventories dependencies and identifies component or license risk.
Threat modeling
Finds design-level threats and mitigations before implementation is complete.
Common exam trap
Shift security left, but do not stop at deployment. Dependencies, configuration, secrets, runtime monitoring, patching, and retirement remain part of software risk.
How to study Domain 8
Step 1: Map security activities to every SDLC phase.
Step 2: Learn threat modeling and secure requirements.
Step 3: Compare SAST, DAST, IAST, RASP, and SCA.
Step 4: Protect the build and deployment pipeline.
Step 5: Practice acquired-software and supply-chain scenarios.