Dev Environment Security — CISSP Study Guide

Bundled into the existing Certified Information Systems Security Professional premium course — no separate purchase.

Included in this chapter:

Method	Runs the app?	Needs source access?	Finds best	Blind to	Earliest in SDLC
SAST (static)	No: analyzes source/bytecode/binary	Yes	Source-level coding flaws (injection, insecure APIs); pinpoints the exact line	Runtime, configuration, and environment flaws; tends to false positives	Coding (very early)
DAST (dynamic)	Yes: attacks from outside	No (black-box)	Runtime/deployment flaws; confirms a finding is actually exploitable	Cannot point to the offending line; only tests reachable surfaces	Testing (running app required)
IAST (interactive)	Yes: instruments from inside	Yes (agent in the runtime)	Correlates code location with runtime confirmation: fewer false positives	Needs coverage from exercising the app; agent adds runtime overhead	Testing (with instrumentation)
SCA	No: inspects the dependency manifest	No (reads components/manifests)	Known-vulnerable third-party components (CVEs) and license risk; feeds the SBOM	Flaws in the team's own first-party code	Coding and continuously after

Cheat sheet

Every tool in the development ecosystem is an attack surface, not just the source code
The SSDF (NIST SP 800-218) hardens the environment and artifacts, not just the code
Choosing a memory-safe, type-safe language is itself a security control
Third-party libraries are inherited risk because a flaw ships inside an already-trusted package
Software Composition Analysis inventories dependencies and flags known-vulnerable components
An SBOM is a component-transparency layer that speeds response but does not prevent vulnerabilities
SAST reads code without running it: earliest, pinpoints the line, but blind to runtime
DAST attacks the running app from outside with no source: confirms exploitability but not the line
IAST instruments the running app to combine code-level location with runtime confirmation
Match the AST method to the flaw class. They are complementary, not interchangeable
The SCM repository is the integrity boundary: govern it with least privilege, branch protection, and peer review
The CI/CD pipeline is both the enforcement gate and a high-value target
Build credentials and signing keys belong in a secrets vault, never hard-coded in pipeline files or source
Sign build artifacts so downstream stages and consumers can verify provenance and detect tampering
The IDE and developer tool sets are part of the supply chain. Manage and patch them
At CISSP altitude, name the control or method and the decision, not the operator keystrokes

Unlock with Premium — includes all practice exams and the complete study guide.

Cheat sheet