Domain 8: Software Development Security
8.1 Understand and integrate security in the Software Development Life Cycle (SDLC):
- Development methodologies (for example, Agile, Waterfall, DevOps, or DevSecOps)
- Maturity models (for example, the Capability Maturity Model (CMM) or the Software Assurance Maturity Model (SAMM))
- Operation and maintenance
- Change management
- Integrated Product Team (IPT)
8.2 Identify and apply security controls in software development ecosystems:
- Programming languages
- Libraries
- Tool sets
- Integrated Development Environment (IDE)
- Runtime
- Continuous Integration and Continuous Delivery (CI/CD)
- Security Orchestration, Automation, and Response (SOAR)
- Software Configuration Management (SCM)
- Code repositories
- Application security testing (for example, Static Application Security Testing (SAST) or Dynamic Application Security Testing (DAST))
8.3 Assess the effectiveness of software security...