(ISC)²

Certified Secure Software Lifecycle Professional (CSSLP)

(CSSLP.AO1) / ISBN : 978-1-64459-229-8
Lessons
Lab
TestPrep
AI Tutor (Añadir)
6 Revisar
Obtenga una prueba gratuita

Habilidades que obtendrás

La certificación Certified Secure Software Lifecycle Professional está dirigida a profesionales de la seguridad de la información que lideran la organización y desempeñan un papel clave en la integración de la seguridad en cada fase del ciclo de vida del software. El examen CSSLP valida las habilidades y los conocimientos necesarios del candidato para la autenticación, autorización y auditoría durante todo el ciclo de vida del desarrollo de software (SDLC), utilizando las mejores prácticas, políticas y procedimientos establecidos por los expertos en ciberseguridad de (ISC)².
Descargar el esquema del curso

1

Introduction

  • Why Focus on Software Development?
  • The Role of CSSLP
  • How to Use This Course?
  • The Examination
  • CSSLP (2020)
2

General Security Concepts

  • General Security Concepts
  • Security Models
  • Adversaries
  • Lesson Review
3

Risk Management

  • Definitions and Terminology
  • Types of Risk
  • Governance, Risk, and Compliance
  • Risk Management Models
  • Risk Options
  • Lesson Review
4

Security Policies and Regulations

  • Regulations and Compliance
  • Legal Issues
  • Privacy
  • Security Standards
  • Secure Software Architecture
  • Trusted Computing
  • Acquisition
  • Lesson Review
5

Software Development Methodologies

  • Secure Development Lifecycle
  • Secure Development Lifecycle Components
  • Software Development Models
  • Microsoft Security Development Lifecycle
  • Lesson Review
6

Policy Decomposition

  • Confidentiality, Integrity, and Availability Requirements
  • Authentication, Authorization, and Auditing Requirements
  • Internal and External Requirements
  • Lesson Review
7

Data Classification and Categorization

  • Data Classification
  • Data Ownership
  • Labeling
  • Types of Data
  • Data Lifecycle
  • Lesson Review
8

Requirements

  • Functional Requirements
  • Operational Requirements
  • Requirements Traceability Matrix
  • Connecting the Dots
  • Lesson Review
9

Design Processes

  • Attack Surface Evaluation
  • Threat Modeling
  • Control Identification and Prioritization
  • Risk Assessment for Code Reuse
  • Documentation
  • Design and Architecture Technical Review
  • Lesson Review
10

Design Considerations

  • Application of Methods to Address Core Security Concepts
  • Interfaces
  • Lesson Review
11

Securing Commonly Used Architecture

  • Distributed Computing
  • Service-Oriented Architecture
  • Rich Internet Applications
  • Pervasive/Ubiquitous Computing
  • Mobile Applications
  • Integration with Existing Architectures
  • Cloud Architectures
  • Lesson Review
12

Technologies

  • Authentication and Identity Management
  • Credential Management
  • Flow Control (Proxies, Firewalls, Middleware)
  • Logging
  • Data Loss Prevention
  • Virtualization
  • Digital Rights Management
  • Trusted Computing
  • Database Security
  • Programming Language Environment
  • Operating Systems
  • Embedded Systems
  • Lesson Review
13

Common Software Vulnerabilities and Countermeasures

  • CWE/SANS Top 25 Vulnerability Categories
  • OWASP Vulnerability Categories
  • Common Vulnerabilities and Countermeasures
  • Input Validation Failures
  • Common Enumerations
  • Virtualization
  • Embedded Systems
  • Side Channel
  • Social Engineering Attacks
  • Lesson Review
14

Defensive Coding Practices

  • Declarative vs. Programmatic Security
  • Memory Management
  • Error Handling
  • Interface Coding
  • Primary Mitigations
  • Learning from Past Mistakes
  • Lesson Review
15

Secure Software Coding Operations

  • Code Analysis (Static and Dynamic)
  • Code/Peer Review
  • Build Environment
  • Antitampering Techniques
  • Configuration Management: Source Code and Versioning
  • Lesson Review
16

Security Quality Assurance Testing

  • Standards for Software Quality Assurance
  • Testing Methodology
  • Functional Testing
  • Security Testing
  • Environment
  • Bug Tracking
  • Attack Surface Validation
  • Testing Artifacts
  • Test Data Lifecycle Management
  • Lesson Review
17

Security Testing

  • Scanning
  • Penetration Testing
  • Fuzzing
  • Simulation Testing
  • Testing for Failure
  • Cryptographic Validation
  • Regression Testing
  • Impact Assessment and Corrective Action
  • Lesson Review
18

Secure Lifecycle Management

  • Introduction to Acceptance
  • Pre-release Activities
  • Post-release Activities
  • Lesson Review
19

Secure Software Installation and Deployment

  • Secure Software Installation and Its Subsequent Deployment
  • Configuration Management
  • Lesson Review
20

Secure Software Operations and Maintenance

  • Secure Software Operations
  • The Software Maintenance Process
  • Secure DevOps
  • Secure Software Disposal
  • Lesson Review
21

Supply Chain and Software Acquisition

  • Supplier Risk Assessment
  • Supplier Sourcing
  • Software Development and Testing
  • Software Delivery, Operations, and Maintenance
  • Supplier Transitioning
  • Lesson Review

1

General Security Concepts

  • Understanding Security Design Tenets
  • Discussing About Access Control Models
  • Understanding Information Flow Models
2

Risk Management

  • Understanding Annualized Loss Expectancy
3

Security Policies and Regulations

  • Understanding Compliance-Based Assessment Regulations
  • Understanding PII and PHI
  • Understanding National Institute of Standards and Technology
4

Software Development Methodologies

  • Discussing About Software Development Methodologies
  • Understanding Secure Development Lifecycle Components
  • Understanding Software Development Models
5

Policy Decomposition

  • Understanding Access Control Mechanisms
6

Data Classification and Categorization

  • Understanding Data Classification Types
  • Understanding Data Ownership Roles
7

Requirements

  • Understanding Functional Requirements
  • Understanding the Requirements Traceability Matrix
8

Design Processes

  • Understanding Documentation
9

Design Considerations

  • Discussing About Security Design Considerations
10

Securing Commonly Used Architecture

  • Understanding Distributed Computing Terms
  • Understanding the Enterprise Service Bus
  • Understanding Cloud Service Models
11

Technologies

  • Understanding X.509 Digital Certificate Fields
  • Understanding Flow Control Technologies
  • Understanding Syslog
  • Understanding Trusted Computing Elements
12

Common Software Vulnerabilities and Countermeasures

  • Discussing About Software Vulnerabilities and Countermeasures
  • Understanding the Buffer Overflow Attack
13

Defensive Coding Practices

  • Understanding Imperative and Declarative Securities
  • Understanding Memory Management
14

Secure Software Coding Operations

  • Understanding Code Analysis Types
15

Security Quality Assurance Testing

  • Discussing About Security Quality Assurance Testing Methods
  • Understanding Functional Testing Types
  • Understanding Security Testing Types
16

Security Testing

  • Understanding the Attack Surface Analyzer
  • Understanding Regression Testing
17

Secure Lifecycle Management

  • Understanding Various Forms of Testing
18

Secure Software Installation and Deployment

  • Understanding Bootstrapping
19

Secure Software Operations and Maintenance

  • Understanding Operations/Maintenance Activities
  • Understanding the Software Disposal Process
20

Supply Chain and Software Acquisition

  • Discussing About Supplier Risk Assessment
  • Understanding Service Level Agreements

¿Alguna pregunta? Consulta las preguntas frecuentes

¿Aún tienes preguntas sin respuesta y necesitas ponerte en contacto?

Contáctanos ahora

599 dólares estadounidenses

Los precios y los impuestos pueden variar de un país a otro.

Pearson VUE

Preguntas de opción múltiple

Se requiere que un candidato tenga un mínimo de cuatro años de experiencia laboral profesional acumulada y paga en el ciclo de vida del desarrollo de software (SDLC) en uno o más de los ocho dominios del (ISC)2 CSSLP CBK, o tres años de experiencia laboral profesional acumulada y paga en SDLC en uno o más de los ocho dominios del CSSLP CBK con un título de cuatro años que conduzca a una licenciatura o equivalente regional en ciencias de la computación, tecnología de la información (TI) o campos relacionados.

El examen contiene 125 preguntas.

180 minutos

700

Aquí está la política de repetición:

  • Si no aprueba el examen la primera vez, podrá volver a realizarlo después de 30 días.
  • Si no aprueba la segunda vez, podrá volver a realizar el examen después de 90 días adicionales.
  • Si no aprueba una tercera vez, puede volver a realizar el examen 180 días después de su intento de examen más reciente.

Tres años

Conozca más sobre el CSSLP

Certified Secure Software Lifecycle Professional (CSSLP)

$279.99

Comprar ahora