Phase 8: Domain 8 — Software Development Security

Input validation — whitelist over blacklist

Output encoding — prevent XSS

Parameterized queries — prevent SQL injection

Error handling — don’t leak stack traces

Least privilege in code — minimal permissions

Defense in depth — multiple layers of validation

Polyinstantiation — same key, different data at different clearance levels

Inference — deriving classified info from unclassified data

Aggregation — combining unclassified data to derive classified conclusions

SQL injection prevention — parameterized queries, stored procedures, ORM

Unit testing — individual functions/methods

Integration testing — components working together

System testing — complete system validation

Acceptance testing — user/business validation

Regression testing — verify fixes don’t break existing functionality

Version control (your git workflows)

Change advisory board (CAB)

Release management, rollback procedures

Configuration baselines and auditing