TOCTOU Explained: Time of Check Time of Use Race Conditions for CISSP
How a TOCTOU race condition turns a passed security check into an exploit, why symbolic links make it dangerous, and how to close the window.
CISSP Domain 8: Software Development Security
Building security into software rather than bolting it on afterwards: where security sits in the development lifecycle, what DevSecOps changes, the race conditions and injection flaws that survive good intentions, and the testing that finds flaws in your own code and in your dependencies.
What the exam outline covers
The ISC2 CISSP exam outline lists these areas for Domain 8 and gives the domain a weighting of 10%. The wording below is a plain-English paraphrase; the outline itself is the source.
- Security in the software development lifecycle and its methodologies
- Security controls in software development ecosystems: toolchains, CI/CD, code repositories
- Assessing the effectiveness of software security
- Assessing the security impact of acquired software
- Secure coding guidelines and standards, including OWASP
Articles
What Is SAST? Static Application Security Testing
SAST reads source code without running it, catching flaws at the cheapest point in the SDLC. A CISSP insight on its strengths, blind spots and CI/CD role.
Key terms
The phased process for building and retiring software, from requirements through design, development, testing, operation, and disposal, with security built into every phase from the start.
A practice that makes security a shared responsibility across development and operations by automating security checks into the CI/CD pipeline instead of a bolt-on review at release.
White-box testing that analyses source code or bytecode without executing the program, catching code-level flaws early in development but missing runtime and configuration issues.
Black-box testing that probes a running application from the outside, finding runtime and configuration flaws without source access, but unable to point to the offending line of code.
Automated inventory of the third-party and open-source components inside an application, mapping each to known vulnerabilities and licence obligations via a software bill of materials.
Reading is half of it. Scenario questions in this domain tend to turn on the distinctions above, and the quickest way to find out which ones you hold is to answer some. The CISSP practice tests cover all eight domains with an explanation for every answer, and the free assessment gives you a baseline first.