Secure Deployment · DevSecOps · Container Security · SBOM · Supply Chain Attacks · Patch Management
Study with Practice Tests →Domains 7 & 8 of the CSSLP CBK (~23% combined). These domains cover how secure software is deployed, operated, maintained, and how the integrity of the software supply chain is protected throughout the lifecycle.
| Domain | Weight | Key Topics |
|---|---|---|
| 1 — Secure Software Concepts | ~10% | CIA triad, design principles, security governance |
| 2 — Secure Software Requirements | ~14% | Security requirements elicitation, use/misuse cases, privacy |
| 3 — Secure Software Architecture & Design | ~14% | Threat modeling, STRIDE, security patterns, Zero Trust |
| 4 — Secure Software Implementation | ~14% | Secure coding, OWASP Top 10, injection, memory safety |
| 5 — Secure Software Testing | ~14% | SAST, DAST, IAST, pen testing, fuzzing |
| 6 — Secure Software Lifecycle Management | ~11% | SDLC models, risk management, security metrics, EOL |
| 7 — Secure Software Deployment, Operations & Maintenance | ~12% | Change management, patch mgmt, IR, config hardening |
| 8 — Supply Chain & Software Acquisition | ~11% | SBOM, third-party risk, SLSA, dependency management |
Covers the practices that ensure software reaches production securely and is operated and maintained with integrity throughout its operational life.
| Severity | CVSS Score | SLA | Process |
|---|---|---|---|
| Critical | 9.0–10.0 | 24–48 hours | Emergency patch, skip normal change window |
| High | 7.0–8.9 | 7 days | Expedited change process |
| Medium | 4.0–6.9 | 30 days | Normal release cycle |
| Low | <4.0 | 90 days | Planned maintenance window |
IR plan, runbooks, security contacts, forensic tools ready before an incident. Tabletop exercises.
Detect the incident via SIEM alert, vulnerability report, or user report. Triage and classify severity.
Isolate affected systems, preserve forensic evidence, stop spread. Do NOT wipe yet — evidence needed.
Remove malware/backdoor, patch vulnerability, revoke compromised credentials. Eliminate root cause.
Restore from clean backup, verify integrity, resume operations with enhanced monitoring.
Post-mortem within 2 weeks, improve controls, update IR plan, share threat intelligence.
Terraform, CloudFormation — all configs stored in version control. Changes reviewed like code. Enables repeatable, auditable deployments.
Ansible, Chef, Puppet compare actual vs desired state continuously. Alert or auto-remediate when drift detected.
Hardening standards for OS, cloud platforms, containers. Baseline for secure configuration. Audited via CIS-CAT scanner.
tfsec and Checkov scan Terraform/CloudFormation templates for misconfigurations before they reach production.
Securing the build pipeline and container ecosystem is essential to preventing supply chain attacks and ensuring only trusted, verified software reaches production.
| Stage | Security Controls | Tools |
|---|---|---|
| Pre-commit | Git hooks, secret scanning | truffleHog, git-secrets, GitGuardian |
| Build | SAST, SCA (dependency scan), image scanning | Semgrep, Snyk, Trivy |
| Test | DAST, IAST, security regression tests | OWASP ZAP, Burp Suite Enterprise |
| Pre-release | Pen test sign-off, IaC scanning, SBOM generation | tfsec, Checkov, CycloneDX |
| Deploy | Signed artifacts, attestation, deployment controls | cosign/Sigstore, OPA/Gatekeeper |
| Runtime | RASP, WAF, anomaly detection, SIEM | Falco, Wazuh, Datadog |
| SLSA Level | Requirements | Guarantees |
|---|---|---|
| L0 — None | No requirements | No guarantees |
| L1 — Documented | Build process documented | Basic provenance available |
| L2 — Hosted | Build service generates provenance | Tamper-evident provenance |
| L3 — Hardened | Non-falsifiable provenance | Source and build integrity |
| L4 — Two-party | Two-person review, hermetic build | Highest assurance, no single point of compromise |
Use Alpine or distroless images — drastically smaller attack surface. Fewer packages = fewer CVEs to patch. Distroless has no shell, making exploitation harder.
Add USER nonroot in Dockerfile. Container escape or RCE as root gives attacker host-level access. Non-root limits blast radius.
Avoid the --privileged flag — grants excessive host access. Use specific capabilities (--cap-add) rather than full privilege escalation.
Trivy, Snyk Container, Clair scan for CVEs in base image layers and application dependencies. Scan at build time, in registry, and at runtime for new CVEs.
Mount container filesystem as read-only where possible — prevents runtime modification. Use tmpfs volumes for writable scratch space when needed.
Sign images with cosign/Sigstore. Use Kubernetes admission controllers (OPA/Gatekeeper) to enforce only signed, scanned images can be deployed.
The software supply chain includes source code, build tools, dependencies, CI/CD pipeline, deployment infrastructure, and update mechanisms. Any compromise in this chain can inject malicious code into the final product.
Attackers compromised SolarWinds' build system. Malicious code injected into Orion software updates affected 18,000+ organizations including US government agencies. Signed by SolarWinds' own certificate — bypassed all signature verification.
Critical RCE vulnerability in the widely-used Log4j library affected millions of applications. Fixed via SCA scanning to detect affected versions + rapid patching within SLAs. Demonstrated the cascading risk of transitive dependencies.
Sophisticated social engineering attack — a malicious actor became a trusted maintainer of the xz compression library over many months, then inserted a backdoor targeting SSH servers on Linux. Caught before widespread deployment.
Attackers modified Codecov's bash uploader script, exfiltrating CI/CD environment variables (secrets) from thousands of organizations that piped the script directly into bash without verification.
A machine-readable inventory of all components in a software product — libraries, frameworks, open-source dependencies, versions, licenses, and relationships.
| Practice | Purpose | Implementation |
|---|---|---|
| Pin exact versions | Prevent unexpected updates | package-lock.json, go.sum, Pipfile.lock |
| Verify integrity | Detect tampered packages | Hash verification, --integrity flag, pip --require-hashes |
| Private registry | Control approved packages | Nexus, Artifactory, AWS CodeArtifact |
| SCA scanning | Find known CVEs in dependencies | Snyk, OWASP Dependency-Check, Dependabot, Grype |
| Minimize dependencies | Reduce attack surface | Audit and remove unused libraries regularly |
10 questions covering Domains 7 & 8 — Secure Deployment, Operations & Supply Chain Security.
Six memorable frameworks and mnemonics to lock in the key CSSLP Domain 7 & 8 concepts for exam day.
Click any card to flip it and reveal the answer. Use the Study Advisor to explore specific topics in depth.
Click a card to flip it ↩
Select a topic to explore key concepts, tools, and exam pointers.