LOGIN | REGISTER NOW | SUBSCRIBE
 
 
News on Monday
more>>
SharePoint Tech Report
more>>


   

 
 
Download Current Issue
ISSUE 3/15/2010 PDF

Need Back Issues?
DOWNLOAD HERE

Receive the print Edition?


 
blogs tab
Microsoft lifts the hood on IE9
Microsoft is previewing IE9.
03/16/2010 01:10 PM EST

People Power enters the green technology market
People Power launches SuRF Developer's Kit for developers looking to get into green technology.
03/16/2010 11:51 AM EST

Windows Phone 7 will not support HTML 5
Windows Phone 7 will not support HTML 5.
03/15/2010 05:51 PM EST

 

Events calendar tab
SharePointPro Summit & Expo
3/16/2010 to 3/19/2010
Las Vegas
Penton Media

TheServerSide Java Symposium
3/17/2010 to 3/19/2010
Las Vegas
TechTarget

EclipseCon
3/22/2010 to 3/25/2010
Santa Clara, Calif.
The Eclipse Foundation

DevConnections
4/12/2010 to 4/14/2010
Las Vegas
Penton Media

MySQL Conf. and Expo
4/12/2010 to 4/15/2010
Santa Clara, Calif.
O'Reilly Media


 
print Printable version 
Most Read Latest News Blog Resources
Mono brings .NET to Android
At Microsoft MIX, Mono will unveil the ability to port .NET applications to the Android op...

Even with its success, .NET causes some consternation
Despite its popularity, the developer community believes that .NET isn't being fully serve...

Going 'all in' on .NET as default runtime
Programmers for Windows Phone 7 will need to use Silverlight and XNA for development

Digg!  Digg
Reddit  Reddit
Slashdot  Slashdot
Share on facebook  Facebook
Share on Twitter  Twitter

BSIMM lays out security blueprint


By Jeff Feinman
March 27, 2009 — 
Cigital and Fortify Software have put together a new maturity model, the Building Security In Maturity Model (BSIMM), to stimulate a cultural change when it comes to creating secure software.

Representatives from Cigital and Fortify conducted interviews and collected data from nine enterprise companies, such as Adobe, EMC, Google and Microsoft. The model is divided into 12 practices, falling under the categories of governance, intelligence, software security development life cycle (SSDL) touch points, and deployment.

According to the BSIMM, an integral piece of governance should be everyone involved in creating and deploying software attaining a common understanding of strategy, along with direction around security objectives. Proper compliance and policy must be in place and appropriate training should be given.

To gain knowledge of potential attacks, a software initiative must identify potential attackers, as well as document the attacks that have already happened and that caused the greatest organizational concern. The initiative must also provide security features and education on security and coding standards. The BSIMM lists architecture analysis, code review and security testing as the key SSDL touch points.

During deployment, software security professionals need to carry out penetration testing and monitor input to the software they run to spot attacks. Additionally, security professionals should ensure their ability to track unauthorized changes to applications and to detect unauthorized activity, according to the BSIMM.

When talking about the BSIMM, Cigital and Fortify stressed the importance of a strong software security group. An average software security group size should be about 1% of the size of the software development organization.

“Every single one of the nine companies that we studied to build the model has an active software security group,” said Gary McGraw, CTO of Cigital. “This suggests that if you’re trying to have software security in your organization carried out by the developers or network security, you should think about what [notable] companies are doing.”

The BSIMM states that software security groups should emphasize security education and mentoring rather than policing for security errors. It preaches the use of automated code review and black box testing.

McGraw said that the steps laid out in the BSIMM are not intended for software developers. Instead, they are intended for people that are trying to teach software developers how to do proper software security.

“Whoever runs your organization that’s worried about the ramifications of bad software security and business impact, that’s the person who needs to understand this work,” he said. “It’s about how to institute a cultural change to create, plan and execute a large scale software security initiative.”

“I don’t know of any other instance where the range of companies that we’re talking about have been willing to discuss their security activities,” said Brian Chess, cofounder and chief scientist of Fortify. “We can say if [that] you’re not doing something out of this core set of activities, you are an outlier. And you need to think about whether that’s a good thing or a bad thing.”


Related Search Term(s): Cigital, security


Share this link: http://www.sdtimes.com/link/33377
 

Add comment


Name*
Email*  
Country     


  • Comment
  • Preview
Loading