Certified Secure Software Lifecycle Professional
Why is CSSLP Certification important for you?
Too often there’s a “patch approach” to keeping software and applications safe — but not on your watch. You make sure security isn’t an after-thought.
Prove you’re an expert with the CSSLP: a global software security certification that recognizes those who have leading application security skills.
As a CSSLP, you have an internationally-recognized ability to incorporate security practices — authentication, authorization and auditing — into each phase of the software development lifecycle (SDLC). The CSSLP shows you can:
- Develop an application security program in your organization
- Reduce production costs, source code vulnerabilities and delivery delays.
- Enhance the credibility of your organization and your team.
- Reduce losses due to insecure software breaches.
Who should attend?
- Software Architect
- Software Engineer
- Software Developer
- Application Security Specialist
- Software Program Manager
- Quality Assurance Tester
- Penetration Tester
- Software Procurement Analyst
- Project Manager
- Security Manager
- IT Director/Manager
Examination
| Domains | Weight |
| 1. Secure Software Concepts | 13% |
| 2. Secure Software Requirements | 14% |
| 3. Secure Software Design | 16% |
| 4. Secure Software Implementation/Programming | 16% |
| 5. Secure Software Testing | 14% |
| 6. Software Lifecycle Management | 10% |
| 7. Software Deployment, Operations and Maintenance | 9% |
| 8. Supply Chain and Software Acquisition | 8% |
| Total |
100% |
Security and Risk Management
- Confidentiality, integrity and availability concepts
- Security governance principles
- Compliance
- Legal and regulatory issues
- Professional ethics
- Security policies, standards, procedures and guidelines
- Asset Security
- Information and asset classification
- Ownership (e.g., data owners, system owners)
- Protect privacy
- Appropriate retention
- Data security controls
- Handling requirements (e.g., markings, labels, storage)
Security Engineering
- Engineering processes using secure design principles
- Fundamental concepts of security models
- Security evaluation models
- Security capabilities of information systems
- Security architectures, designs and solution elements vulnerabilities
- Web-based systems vulnerabilities
- Mobile systems vulnerabilities
- Embedded devices and cyber-physical systems vulnerabilities
- Cryptography
- Site and facility design secure principles
- Physical security
Communication and Network Security
- Secure network architecture design (e.g., IP & non-IP protocols, segmentation)
- Secure network components
- Secure communication channels
- Network attacks
- Identity and Access Management
- Physical and logical assets control
- Identification and authentication of people and devices
- Identity as a service (e.g., cloud identity)
- Third-party identity services (e.g., on-premise)
- Access control attacks
- Identity and access provisioning lifecycle (e.g., provisioning review)
Security Assessment and Testing
- Assessment and test strategies
- Security process data (e.g., management and operational controls)
- Security control testing
- Test outputs (e.g., automated, manual)
- Security architecture vulnerabilities
Security Operations
- Investigations support and requirements
- Logging and monitoring activities
- Provisioning of resources
- Foundational security operations concepts
- Resource protection techniques
- Incident management
- Preventative measures
- Patch and vulnerability management
- Change management processes
- Recovery strategies
- Disaster recovery processes and plans
- Business continuity planning and exercises
- Physical security
- Personnel safety concerns
Software Development Security
- Security in the software development lifecycle
- Development environment security controls
- Software security effectiveness
- Acquired software security impact
Exam format
Duration: Up to 6 hours
Number of questions: 250 questions
Question format: Multiple choice and advanced innovative questions
Passing grade: A passing score is 700 out of 1000 points
Certification
When it comes to software security certifications, we know you have choices. The CSSLP is the right choice for you if you:
- Are involved in any phase of the software development lifecycle (SDLC), and you’re responsible for application security practices.
- Want to show initiative. You’re always looking for new ways to challenge yourself and create safer applications from desktop to cloud.
- Want to stay on top of your craft. You need to stay current, so you can conquer new application vulnerabilities.
- Would like to be seen as the subject matter expert on security vulnerabilities — such as with application stacks, single sign-on initiatives or webhook integrations.
- Want to ensure that security is not an after-thought in software development.
Benefits of CSSLP
The CSSLP certification is accredited by the American National Standards Institute (ANSI). This means it complies with the International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) 17024 Standards.
How do I get started with CSSLP Training?
If you are willing to take the challenge and obtain a CSSLP certification, our experts will ensure a valuable experience, whereby your needs will be met and you will become part of our global network.
