Official (ISC)² CSSLP Domain 7 Software Deployment

Official (ISC)² CSSLP Domain 7 Software Deployment, Operations, and Maintenance Complete Solutions Authorization to operate ️The official management decision given by a senior organizational official to authorize operation of an information system and to explicitly accept the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security controls. Resource: Business Impact Analysis (BIA) ️An analysis of an information system's requirements, functions, and interdependencies used to characterize system contingency requirements and priorities in the event of a significant disruption Resource: Nist Bytecode ️A reference to code that has been generated by compiling Java source code. Bytecode is low level and can be interpreted/executed on any system/platform that provides a Java virtual machine and runtime environment. Certificate (digital certificate) ️A reference to a public key certificate, as a component of the public key infrastructure (PKI), and based on the X.509 standard. Certificate fields include information that identifies the issuer of the certificate, owner of the certificate, owner's public key, and validity period of the certificate, among other fields. Disaster Recovery Plan (DRP) ️Management policy and procedures used to guide an enterprise response to a major loss of enterprise capability or damage to its facilities. The DRP is the second plan needed by the enterprise risk managers and is used when the enterprise must recover (at its original facilities) from a loss of capability over a period of hours or days. Resource: NIST, Dynamic application security testing (DAST) ️A reference to a form of application security testing method and associated tools and technologies that focus on testing the application from the outside and in the runtime environment. Primarily used for web applications, DAST is appropriate for detecting certain types of security flaws/vulnerabilities, but most importantly adequate for detecting configuration issues. DAST has its own pros and cons. Hardening (software) ️A reference to the process of applying secure configurations (to reduce the attack surface) and locking down various software, including operating system, web server, application server, application, etc. Hardening is normally performed based on industry guidelines and benchmarks such as those provided by the Center for Internet Security (CIS). Interactive application security testing (IAST) ️A reference to combining/integrating SAST and DAST to improve testing and provide behavioral analysis capabilities to pinpoint the source of vulnerabilities. Java Runtime Environment (JRE) ️A reference to a software environment that allows for programs compiled for a typical JVM implementation to run. Software release ️A reference to the distribution of software for use. Public release of software may