The course is part of this learning path
This course covers the first section of CSSLP Domain 6 and looks at the topic of software acceptance.
Learning Objectives
Obtain an understanding of the following topics:
- Software qualification testing
- Qualification testing plan
- Qualification testing hierarchy
Intended Audience
This course is intended for anyone looking to develop secure software as well as those studying for the CSSLP certification.
Prerequisites
Any experience relating to information security would be advantageous, but not essential. All topics discussed are thoroughly explained and presented in a way allowing the information to be absorbed by everyone, regardless of experience within the security field.
We want to be sure that as a CSSLP candidate you understand the fundamentals of software assurance processes, you become familiar with the terminology of the acceptance processes, you become familiar with the actions done within the acceptance processes, you will become familiar and comfortable with the idea of the performance of the verification and validation steps, and we will examine and assess the implications of this process and its wider impacts.
Now it would seem obvious that before any software would be accepted or can be accepted, it would have to be put through a process to confirm that it meets the specified quality and performance standards. Whether the product was developed in-house or through an outsourced third party makes no difference. Software acquired from any source should be put through the same rigorous acceptance process. Now, it is imperative that a thorough understanding of the importance of the acceptance process be established and that the process itself to obtain this quality assurance be institutionalized.
Now, before accepting software for deployment into the production environment or release to customers, it is important to ensure that the software meets required compliance quality, functional assurance, meaning security requirements. Verification and validation, otherwise known as V&V, of only the business functionality to accept software for release can prove insufficient and can backfire from a security standpoint. Is also critical to understand the impact that the accepted software will have on the existing computing ecosystem irrespective of whether it has been developed, that is, built or procured, bought, and integrated with it.
Security requirements need to be verified and security controls, that is, safeguards and countermeasures validated by an internal and/or independent third party security testing. Software must not be deployed or released until it has been fully tested and attested to, and thus determined that the residual risk is within the acceptable risk threshold as established by the business owner. Additionally, in the cases where software is procured from an external software publisher, certain non-technical protection mechanisms need to be in place as acceptance criteria and these must be validated and verified as well.
Mr. Leo has been in Information System for 38 years, and an Information Security professional for over 36 years. He has worked internationally as a Systems Analyst/Engineer, and as a Security and Privacy Consultant. His past employers include IBM, St. Luke’s Episcopal Hospital, Computer Sciences Corporation, and Rockwell International. A NASA contractor for 22 years, from 1998 to 2002 he was Director of Security Engineering and Chief Security Architect for Mission Control at the Johnson Space Center. From 2002 to 2006 Mr. Leo was the Director of Information Systems, and Chief Information Security Officer for the Managed Care Division of the University of Texas Medical Branch in Galveston, Texas.
Upon attaining his CISSP license in 1997, Mr. Leo joined ISC2 (a professional role) as Chairman of the Curriculum Development Committee, and served in this role until 2004. During this time, he formulated and directed the effort that produced what became and remains the standard curriculum used to train CISSP candidates worldwide. He has maintained his professional standards as a professional educator and has since trained and certified nearly 8500 CISSP candidates since 1998, and nearly 2500 in HIPAA compliance certification since 2004. Mr. leo is an ISC2 Certified Instructor.