CISSP Domain 8.4: Evaluating Acquired Software Security
May 07, 2026EPISODE SUMMARY
-
Podcast: CISSP Cyber Training Podcast | Host: Shon Gerber, vCISO, CISSP | Episode: CCT 345 (Replay) | Duration: 22:51
-
Opening News Segment: Shon covers the Chinese state-sponsored breach of the U.S. Treasury Department via BeyondTrust's PAM/Remote Support platform, using it as a real-world lens for cross-domain attacks. Adversaries (attributed to Silk Typhoon/APT27) exploited a compromised API key and zero-day vulnerabilities to move laterally across endpoints, cloud platforms, and third-party connections — logging in rather than breaking in. He references a CrowdStrike-sponsored article on defending against these threats.
-
CISSP Domain/Topic: Domain 8 — Software Development Security | Sub-domain 8.4: Assess the Security Impact of Acquired Software
-
Key Topics Table:
| Topic | Key Takeaway |
|---|---|
| Open Source Evaluation | Assess community activity and maintenance signals; orphaned projects = hidden risk |
| COTS Software Risk | No source code access makes deep vulnerability assessment nearly impossible |
| Managed Services / SaaS | Prioritize encryption at rest/in transit and clear SLAs defining incident response |
| Shared Responsibility Model | Cloud security clarity requires knowing who owns what — esp. account management |
| Threat Modeling | Maps dependency risk and attack vectors across the software supply chain |
| Dependency Scanning | Detects vulnerable libraries and frameworks embedded in acquired software |
| Sandbox Testing | Validates software behavior in a controlled environment before production |
| Periodic Reassessment | Evolving threats require ongoing software security reviews, not just point-in-time |
| Pen Testing vs. Static Analysis | Pen testing simulates real-world attacks; static analysis inspects code for flaws |
| SLA Review | Defines performance metrics and incident response expectations for managed services |
| Open Source Licensing | Ensures legal/IP compliance; critical for developers and organizations alike |
| Third-Party SDLC Risk | Lack of control over vendor development lifecycle is the primary integration risk |
- Resources Mentioned:
- 🔗 FreeCISSPQuestions.com — 360 free CISSP practice questions delivered to your inbox
- 🔗 CISSPCyberTraining.com — Free and paid CISSP training resources
- 🔗 ReduceCyberRisk.com — Cybersecurity consulting, partnerships, and software sourcing
CISSP Cyber Training Academy Program!
Are you an ambitious Cybersecurity or IT professional who wants to take your career to a whole new level by achieving the CISSP Certification?
Let CISSP Cyber Training help you pass the CISSP Test the first time!
