9. Domain 8 — Software Development Security (10%)
Most security vulnerabilities don't arrive via sophisticated zero-day attacks — they are written into software by developers who didn't know or didn't apply secure coding practices. Domain 8 addresses security at the source: the software development lifecycle. Understanding how software is built, where vulnerabilities are introduced, and how to systematically reduce them is foundational to preventing the incidents that Domains 6 and 7 are designed to detect and respond to.
At 10% weight, Domain 8 covers the secure SDLC, common vulnerability classes, secure coding principles, and software security testing. The CISSP tests whether you understand the security implications of development decisions — not whether you can write secure code, but whether you can recognize insecure patterns, understand when in the lifecycle security should be applied, and choose the right testing method for the right vulnerability class.
⚠️ Domain Trap: Domain 8 requires precision about where in the SDLC security activities belong. Threat modeling belongs in design — not after the code is written. Code review is most effective at implementation — not at deployment. DAST requires a running application — it cannot be run on source code. Exam questions test these sequence and applicability relationships, not just definitions.
