Buffer Overflow and the Stack Canary Explained for CISSP
How a buffer overflow overwrites the return address, how a stack canary detects it before the return, and why the fix belongs in the code, not the platform.
Software Development Security
Building security into software rather than bolting it on afterwards: where security fits in the development life cycle, what DevSecOps changes, and the testing that finds flaws in your code and in your dependencies. CISSP Domain 8.
Articles
TOCTOU Explained: Time of Check Time of Use Race Conditions for CISSP
How a TOCTOU race condition turns a passed security check into an exploit, why symbolic links make it dangerous, and how to close the window.
What Is SAST? Static Application Security Testing
SAST reads source code without running it, catching flaws at the cheapest point in the SDLC. A CISSP insight on its strengths, blind spots and CI/CD role.
Key terms
A practice that makes security a shared responsibility across development and operations by automating security checks into the CI/CD pipeline instead of a bolt-on review at release.
Black-box testing that probes a running application from the outside, finding runtime and configuration flaws without source access, but unable to point to the offending line of code.
Automated inventory of the third-party and open-source components inside an application, mapping each to known vulnerabilities and licence obligations via a software bill of materials.
The phased process for building and retiring software, from requirements through design, development, testing, operation, and disposal, with security built into every phase from the start.
White-box testing that analyses source code or bytecode without executing the program, catching code-level flaws early in development but missing runtime and configuration issues.