BSIMM crafts model for building in software security

By David Rubinstein

With the sample size of participating companies having tripled in one year, the folks behind the Building Security In Maturity Model (BSIMM) have found that most have an internal group responsible for security, and that 15 activities to ensure security are almost universally done.

The BSIMM project began in March 2009 as a joint effort between Cigital and Fortify Software to record what organizations are doing to build security into their software and organizations. Starting with input from nine companies, the number of participating organizations has grown to 30, according to Gary McGraw, CTO at security consulting firm Cigital. He said the larger sample size allowed the group to statistically validate the model, and that the levels for measuring security are sound.

McGraw explained that the BSIMM team observed 109 activities that the 30 organizations do to secure their software, and those activities are broken down into 12 “large-scale conceptual buckets,” he said, such as training or code review. Then the activities within those buckets are further divided into three levels: The things that most of the organizations do are at the first level, while level 3 is for “the rocket science, things that are rarely done but are very cool,” he added.

Organizations can download BSIMM2 to compare their own activities to what other groups are doing and plan their security strategy going forward, explained Brian Chess, cofounder and chief scientist at Fortify Software, which makes vulnerability detection software and provides security services.

Chess said that the companies studied all do good hosting and network security. “They all have firewalls, that’s no great revelation,” he said. “But there are 14 other activities that almost all the companies universally do.”

Synergetics India : Our Database Offerings experience help to reduce the Opportunity cost for our clients in terms of development time specially related to latest in technology.