CSSLP Certification Training Course

2.1 Defining software security requirements
2.2 Identifying and analyzing compliance, data classification, and privacy requirements
2.3 Misuse and abuse cases: Development
2.4 Security Requirement Traceability Matrix (STRM): Development
2.5 Ensuring the security requirements flow down to suppliers/providers

3.1 Threat modeling
3.2 Defining the security architecture
3.3 Securing interface design
3.4 Architectural risk assessment
3.5 Non-functional model security properties and constraints
3.6 Data modeling and classification
3.7 Reusable secure design evaluation and selection
3.8 Security architecture and design review
3.9 Defining a secure operational architecture
3.10 Implementing secure architecture and design principles, patterns, and tools

4.1 Adherence to relevant secure coding practices
4.2 Code analysis for security risks
4.3 Security controls: Implementation
4.4 Addressing security risks
4.5 Securely reusing third-party code or libraries
4.6 Securely integrating components
4.7 Security during the building phase

5.1 Security test cases: Development
5.2 Security testing strategy and plan development
5.3 Documentation verification and validation
5.4 Identifying undocumented functionality
5.5 Analyzing security implications of test results
5.6 Classifying and tracking security errors
5.7 Test data security
5.8 Verification and validation testing

6.1 Configuration and version control security
6.2 Defining the strategy and the roadmap
6.3 Managing security within a software development methodology
6.4 Identifying security standards and frameworks
6.5 Defining and developing security documentation
6.6 Security metrics: Development
6.7 Decommission software
6.8 Security status reporting
6.9 Promoting security culture in software development
6.10 Implementing continuous improvement

7.1 Perform Operational Risk Analysis
7.2 Release Software Securely
7.3 Securely Store and Manage Security Data
7.4 Ensure Secure Installation
7.5 Perform Post-Deployment Security Testing
7.6 Obtain Security Approval to Operate (e.g., risk acceptance, sign-off at appropriate level)
7.7 Perform Information Security Continuous Monitoring (ISCM)
7.8 Support Incident Response
7.9 Perform Patch Management (e.g. secure release, testing)
7.10 Perform Vulnerability Management (e.g., scanning, tracking, triaging)
7.11 Runtime Protection (e.g., Runtime Application Self-Protection (RASP), Web Application Firewall (WAF), Address Space Layout Randomization (ASLR))
7.12 Support Continuity of Operations
7.13 Integrate Service Level Objectives (SLO) and Service Level Agreements (SLA) (e.g., maintenance, performance, availability, qualified personnel)

8.1 Implement Software Supply Chain Risk Management
8.2 Analyze Security of Third-Party Software
8.3 Verify Pedigree and Provenance
8.4 Ensure Supplier Security Requirements in the Acquisition Process
8.5 Support contractual requirements (e.g., Intellectual Property (IP) ownership, code escrow, liability, warranty, End-User License Agreement (EULA), Service Level Agreements (SLA))