Development Environment
Start course

This is the fourth course in Domain 3 of the CSSLP certification and covers the essential ideas, concepts, and principles that you need to take into account when building secure software.

Learning Objectives

  • Understand the process and controls available to secure your software
  • Learn about the main security technologies available

Intended Audience

This course is intended for anyone looking to develop secure software as well as those studying for the CSSLP certification.


Any experience relating to information security would be advantageous, but not essential. All topics discussed are thoroughly explained and presented in a way allowing the information to be absorbed by everyone, regardless of experience within the security field.


We have, of course, in the development that we're talking about, a programming language environment. One of the things that any craftsman, any programmer, any developer will tell you is that the product cannot be any better than how well the tools have been calibrated and used. So it is the case that secure setup and control of this development environment will do much to ensure that secure activities only are performed and that sufficient control is maintained over the work in progress, as well as the operation and usage of the tools used in it.

Now, performance within this environment must also be governed by a security policy that is placed over it, and the procedures to be used within it. And typically, they would be subject to these kinds of conditions. We need to control the separation of duties, if and where possible. We have to be sure that proper oversight and review processes outside of the controls themselves so that we have insight into how well they're working must also be possible.

As is very common in development environments, we need to be sure that we control code and library controls to prevent any sort of contamination or manipulation of the tools. And again, we have to treat the security requirements as intrinsic to the product on balance with the intended product's purpose and utility. One of the things we are trying to avoid, of course, is employing unmanaged code.

Now, unmanaged code does have certain advantages in performance, but the thing that we're trying to avoid is enabling unmitigated risks to manifest themselves inside the program once it's finished, which might include very dangerous things like buffer overflows. One of the tools that we use quite commonly is this sandboxing.

Now, the sandboxing creates a virtual environment in which non-native code can execute, but only within the confines of the sandbox itself. They utilize all the intended components provided within the sandbox and allow us to have proper control for everything that may be outside of the sandbox. Now within cloud environment, sandboxing is typically used to run untested or untrusted code in a tightly controlled environment. In a non-cloud environment, it would be very much the same, though it would be configured more to our needs and our acceptance of risk than it would be to a more general.

About the Author
Learning Paths

Mr. Leo has been in Information System for 38 years, and an Information Security professional for over 36 years.  He has worked internationally as a Systems Analyst/Engineer, and as a Security and Privacy Consultant.  His past employers include IBM, St. Luke’s Episcopal Hospital, Computer Sciences Corporation, and Rockwell International.  A NASA contractor for 22 years, from 1998 to 2002 he was Director of Security Engineering and Chief Security Architect for Mission Control at the Johnson Space Center.  From 2002 to 2006 Mr. Leo was the Director of Information Systems, and Chief Information Security Officer for the Managed Care Division of the University of Texas Medical Branch in Galveston, Texas.


Upon attaining his CISSP license in 1997, Mr. Leo joined ISC2 (a professional role) as Chairman of the Curriculum Development Committee, and served in this role until 2004.   During this time, he formulated and directed the effort that produced what became and remains the standard curriculum used to train CISSP candidates worldwide.  He has maintained his professional standards as a professional educator and has since trained and certified nearly 8500 CISSP candidates since 1998, and nearly 2500 in HIPAA compliance certification since 2004.  Mr. leo is an ISC2 Certified Instructor.

Covered Topics