slide1 n.
Skip this Video
Loading SlideShow in 5 Seconds..
CSSLP PowerPoint Presentation
Download Presentation

Loading in 2 Seconds...

play fullscreen
1 / 30

CSSLP - PowerPoint PPT Presentation

  • Uploaded on

The. CSSLP. Deconstructed. And other topics related to Software S ecurity. Alexander J. Fry Founder, Strong Crypto Who am I?. Founder – Strong Crypto , a software security consultancy (ISC) 2 SME – question writer for the CSSLP examination

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript




And other topics related to Software Security

Alexander J. Fry

Founder, Strong Crypto

who am i
Who am I?
  • Founder – Strong Crypto, a software security consultancy
  • (ISC)2 SME – question writer for the CSSLP examination
  • Member – OWASP Global Industry Committee
  • Co-author - The CSSLP Prep Guide
  • I’m a hands-on security professional. I perform code reviews and security testing, work with software developers, and train personnel.
  • I’m here to share my perspectives on the CSSLP and other topics in software security.
  • This is an informal presentation. Feel free to contribute to the discussion while it is underway. Just raise your hand and I’ll call on you when I get to a stopping point.
  • All of the opinions expressed in this presentation are my own, but some of the CSSLP introductory material is from (ISC)2.
what is the csslp
What is the CSSLP?
  • Certified Secure Software Lifecycle Professional (CSSLP)
  • It is a top-level (base) credential just like the CISSP
  • Professional certification program
  • Takes a holistic approach to security in the software lifecycle
  • Tests candidates competency; knowledge, skill, and abilities (KSAs); to significantly mitigate the security concerns

Source: (ISC)2 – CSSLP Launch Presentation

  • The purpose of the Certification is to provide a credential that speaks to the individual’s understanding of and ability to deliver secure software through the use of best practices.
  • The target professionals for this Certification would be anyone who is directly and in some cases indirectly involved in the Software Lifecycle.

Source: (ISC)2 – CSSLP Launch Presentation

software lifecycle stakeholder chart
Software Lifecycle Stakeholder Chart

Top Management

Business Unit Heads


IT Manager

Client Side PM

Security Specialists

Industry Group

Delivery Heads

Software LifecycleStakeholders

Application Owners









Project Managers/

Team Leads

Technical Architects

Primary Target

Secondary Target

Source: (ISC)2 – CSSLP Launch Presentation

isc 2 csslp cbk domains
(ISC)2 CSSLP CBK Domains
  • Secure Software Concepts
  • Secure Software Requirements
  • Secure Software Design
  • Secure Software Implementation/Coding
  • Secure Software Testing
  • Software Acceptance
  • Software Deployment, Operations, Maintenance, and Disposal
secure software concepts
Secure Software Concepts
  • fundamental knowledge for understanding the security implications of software development, and the mechanisms to impose security constraints on the behavior, use, and content of a software system. This includes security design and information assurance principles, risk management, software architectures, legal issues, standards, acquisition methods, information security and software maturity models.
secure software requirements
Secure Software Requirements
  • the overall software specification should include both functional and nonfunctional requirements. The nonfunctional requirements of secure software address issues such as how the software application will: remain dependable under hostile operating conditions; resist compromise by an attacker through the exploitation of vulnerabilities or insertion of malicious code; and be resilient enough to recover quickly, containing damage to itself, data, resources, and external components on which it relies.
secure software design
Secure Software Design
  • fundamental activities that approach the definition of the software from a security perspective in order to decrease the likelihood that the design specification will contain flaws. These activities include identifying and minimizing the software's attack surface, performing threat modeling, and following security design principles.
secure software implementation coding
Secure Software Implementation/Coding
  • software developers should follow secure coding best practices and standards, understand and avoid common vulnerabilities and implement countermeasures, and use tools and techniques such as static analysis and code review to avoid introducing flaws that can lead to security vulnerabilities.
secure software testing
Secure Software Testing
  • activities for evaluating a software application in a runtime environment that most closely resembles its production environment. Many testing activities require the application to be functionally complete and follow standards and methodologies such as ISO 9126, the SSE-CMM, and the Open Source Security Testing Methodology Manual (OSSTMM). Security testing should assess the security properties and behaviors of the software application as it interacts with external entities and as its own components interact with each other. An analysis of test results forms the basis for assessing risk and means of remediation.
software acceptance
Software Acceptance
  • is concerned with ensuring that the software is ready to be released. This involves pre-release or pre-deployment activities such as generating test data that shows that all prescribed tests have been executed and accepted; and post-release activities such as an independent review of the software conducted by a third-party or by an independent security team of the organization.
software deployment operations maintenance disposal
Software Deployment, Operations, Maintenance, Disposal
  • is concerned with maintaining information assurance during installation, deployment, operation, maintenance, and disposal of secure software systems.
where is the csslp first attempt
Where is the CSSLP? First Attempt.

Information Assurance

Software Assurance



CISSP Application Development Security Domain

csslp certification requirements
CSSLP Certification Requirements
  • Roughly:
  • Examination registration form
  • Signed candidate agreement and adherence to (ISC)2 Code of ethics
  • Proof of 4 years of FT experience in the Software Development Life Cycle (SDLC) process or 3 years plus 1 year waiver of experience for degree in an IT related field
  • $599
  • Candidate will have to pass the official (ISC)2 CSSLP certification examination and complete the endorsement process
  • An Associate of (ISC)2 Program will apply to those who have passed the exam but still need to acquire the necessary minimum experience requirements
  • See for updated requirements
key players
Key Players
  • While there is no indication that other organizations in this space are addressing the knowledge areas in the same manner as the CSSLP, the following are addressing software development and/or security in the software lifecycle:
  • IEEE: CSDA and CSDP (Software Development)
  • SANS: GSSP-C, GSSP-J (Language specific secure coding)
  • ISSECO: CSSE (Entry level education program with certificate of completion)
  • DHS: Software Assurance Initiative (Awareness Program/Forum)
  • Vendor-Specific: Sun Microsystems SCJP, Microsoft MCSD, Symantec - based on internal lifecycle process or technology specific

Source: (ISC)2 – CSSLP Launch Presentation




Software Coder

Certification Program



Software Coder

Certification Program




Education Program

Certificate of Completion





Awareness Effort



Associate Level





Certification Program

Vendor-Specific Credentials

CSSLP CBK Overlap with other Certifications/Programs



Professional Certification


Source: (ISC)2 – CSSLP Launch Presentation

state of the csslp
State of the CSSLP
  • International Marketing Efforts
  • ANSI/ISO/IEC 17024 accreditation
  • DoD 8570.1 directive
  • CSSLP Education Seminars: (ISC)2 held one from January 11-15, 2010 in Ashburn, VA
  • The first prep guide is for sale: The CSSLP Prep Guide.
do you need the csslp
Do you need the CSSLP?
  • Certification vs. Legion Against Meaningless Certifications (LAMN)
  • “Anyone who believes that a credential automatically conveys some magical knowledge that you didn't have before is just as overly-simplistic as someone who disparages all credentials equally. It just isn't a black and white world. – Paco Hope“
  • “Because academia can't produce enough surgeons to satisfy all security demands (and indeed because entire armies of less specialized `healthcare professionals’ are necessary), the idea of a certification makes plenty of practical sense. – Gary McGraw” In reference to the CISSP -
  • “A second term CISSP demonstrates more value than a first year CISSP”
  • Are you a stakeholder in the SDLC?
  • Is the CSSLP going to be part of your lifelong learning program?
  • Is it important to your career to be recognized as a CSSLP?
you are the ceo of you inc
You are the CEO of YOU INC
  • How should the CSSLP be pronounced? C.SLIP; C.S.S.L.P, CIS.LIP (sis-lip) Where is the (ISC)2 guidance?
  • Why not the Certified Software (Security) Assurance Professional C.SWAP? Building Security In is Implied
  • “Effective career management is going to be critical to your personal success and attainment of your individual career goals.” – Lee Kushner
the csslp prep guide
The CSSLP Prep Guide
  • The first and only (for a few more months) prep guide for the CSSLP
  • Broad coverage of all seven domains of the CSSLP CBK
  • A software security assurance text book disguised as a certification prep guide
  • Uses the attacker’s perspective to teach some of the security concepts
  • Almost 700 pages, lots of references to other tools and resources, end of chapter practice questions, testing engine on CD, comprehensive glossary
additional topics
Additional Topics
  • Software Security Risk
  • Recent Threats
  • 3rd Party Software
  • Addressing Risk for 3rd Party Software
software security risk
Software Security Risk
  • Need to follow a risk-driven approach to improving the security of software.
  • Applications come from: in-house, outsourced, commercial, open source or a combination, e.g., commercial but customized in-house, open source libraries in in-house applications
  • For existing legacy applications, do you deploy real-time protections or take off-line and fix?
  • Compliance should be leveraged to build/acquire more secure applications
  • Use the attacker’s perspective to determine risk, e.g., threat modeling, understanding the deployment environment(s)
  • Security problems will emerge! To keep up with emerging threats, you need to perform regular maintenance, periodically test, and continuously monitor applications.
recent threats
Recent Threats
  • “Symantec is grappling with a date-stamp problem that has seen all its security updates dated 2010 rejected by its own servers.” -
  • “Adobe Zero-Day Attack Solution: Disable JavaScript” – No patch available: Many corporate applications use JavaScript in PDFs for important functions like forms processing and it’s used by Google Docs for printing support.
  • “NIST-certified USB Flash drives with hardware encryption cracked” – FIPS 140-2 Level 2 drives AES 256-bit.
3rd party software
3rd Party Software
  • Lack of visibility into the third party software development lifecycle.
  • Unknown level of software assurance.
  • Little or no access to source code.
  • Limited internal resources to address this risk.
  • Don’t want to introduce vulnerabilities into the organization.
  • Want to be proactive instead of reactive.
addressing risk for 3 rd party software
Addressing Risk for 3rd Party Software
  • “Contract language should specify that security assurance will be provided as a condition for accepting deliverable applications.” – Gartner
  • DHS Build Security In Web Site: “Software Assurance (SwA) in Acquisition: Mitigating Risks to the Enterprise”
  • OWASP Legal Project: Contract Annex
  • For a commercial vendor that does not have the required assurance evidence, use an expert consultant or a Software as a service (SaaS) solution that supports static and dynamic testing:
  • Fortify on Demand: any 3rd party development team can test and score the security of their application, review results, and then publish a report back to their customer.
  • Veracode: uses binary analysis (doesn’t require source code) to allow transparency into the security of COTS or outsourced applications.
  • Open source software: Fortify Open Review Project identifies and reports bugs and security vulnerabilities in widely used open source software. Have the developers submit the software.
open web application security project
Open Web Application Security Project
  • Focused on improving the security of application software. Mission is to make application security visible, so that people and organizations can make informed decisions about true application security risks. All materials are available under a free and open software license
  • I’m a member of the Global Industry Committee at OWASP:
  • Has monthly meetings like ISSA and hosts worldwide conferences like OWASP App Sec DC 2009 – slides from the presentations are available at
  • Web Site:
  • Twitter:
  • Facebook:
  • LinkedIn: