9.3. Software Security Controls
💡 First Principle: Most vulnerabilities are not novel — they are variations of the same foundational mistakes: trusting user input, mishandling memory, failing to enforce authorization at every access point, and logging too little (or too much). The OWASP Top 10 exists because the same vulnerability classes have persisted for decades. Secure coding is not about memorizing every possible attack — it's about internalizing a small set of defensive principles that prevent entire categories of flaws.
The CISSP does not test whether you can write secure code. It tests whether you can recognize insecure patterns, understand which controls prevent which vulnerability classes, and make architectural decisions that reduce the likelihood and impact of software vulnerabilities across the organization.
Why this matters: OWASP Top 10 categories, input validation strategies (allowlist vs. denylist), and the distinction between client-side and server-side validation are directly tested. Exam questions frequently present a vulnerability scenario and ask which control would have prevented it.
⚠️ Common Misconception: "Input validation only needs to happen on the client side (browser/app)." Client-side validation improves user experience — it is not a security control. An attacker bypasses client-side validation trivially by using a proxy tool (Burp Suite, ZAP) to modify requests after they leave the browser. Server-side validation is mandatory; client-side is optional convenience.
