Application Security //

Database Security

10/30/2013
08:00 AM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Software Security Maturity Plods Along

Building Security In Maturity Model (BSIMM) project releases fifth annual study results

While there is certainly room for improvement, the software vendor and financial services communities are making a steadily improving progression in maturing their software security practices, according to a new study out today by the Building Security In Maturity Model (BSIMM) project. BSIMM's fifth version of an industrywide study examines in-depth the secure development practices of many of the globe's most influential firms.

"Here's the real take-home lesson: We know how to do software security on planet Earth, and now we just have to do it," says Dr. Gary McGrw, CTO of Cigital and one of the scientists in charge of the study. "There's a lot of people who say you should do it this way or that way, and there are opinions and conjecture. But what we've done is collect a set of facts so that people can refer to them and know how to approach software security as grown-ups."

[How do you know if you've been breached? See Top 15 Indicators of Compromise.]

McGraw worked with Jacob West, CTO of enterprise security products at HP, and Sammy Migues, principal at Cigital, to personally observe practices at the firms in question, which included heavy hitters Bank of America, Microsoft, Qualcomm, and Salesforce among the ranks. During the course of five years, the BSIMM studies have grown from just a handful of firms and activities observed to include more than 67 companies and 112 observable activities broken into 12 common practices and four categories: governance, intelligence, software secure development life cycle touch points, and deployment.

Among the findings was that of the 112 potential software security activities observed by BSIMM, studied firms used anywhere between 13 and 93 of these activities, with a normal bell-curve distribution. The bulk of firms had anywhere between 19 and 54 activities in place. The study found that leading firms, on average, employ one full-time software security specialist for every 71 developers.

Some of the activities showing the most improvements among measured organizations include the delivery of on-demand individual training for developers, the internal publishing of data about software security, the translation of compliance constraints to software security requirements, the use of metrics, the inclusion of software security SLAs in vendor contracts, and the creation of a top N bugs list.

The BSIMM project takes these observations to help inform the development of a scorecard against which other organizations can measure their software security maturity and start to target improvements.

According to Jim Routh, chief information security officer of Aetna and a founding board member of BSIMM, the scorecard can provide meaningful guidance in building out software security programs.

"The BSIMM is an instrumental tool to determine the maturity and effectiveness of an organization's software security activities, and we use it to measure the progress in improving software security year over year," says Routh, who has personally led five software security initiatives at five different firms.

McGraw says that unlike other best practices guides, this one doesn't necessarily prioritize activities or outline a path to take.

"Understand that it's not a path or a prescriptive guide -- we have not produced a methodology," he says. "It's a descriptive understanding of what 67 other firms are doing."

However, there is an important first step outlined by the BSIMM document, and that is ensuring an organization has a software security group in place -- according to the report authors, every single one of the companies studied has such a group in place, and any of the additional activities would be near impossible to accomplish without that infrastructure. Beyond that, McGraw says that organizations should also be looking to equally weight the importance of the 12 practices under which the observed activities fall.

While this may seem overwhelming to some low maturity organizations, McGraw says one of the lessons to understand is that there is nothing wrong with being in the beginner stages of the process.

"The message needs to be that it's OK to be getting started, just for God's sak-- get started," he says. "Ultimately, getting started is easier when you can measure what you're doing, and that's what BSIMM is for."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Free Tool Scans for Chrome Extension Safety
Dark Reading Staff 2/21/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6485
PUBLISHED: 2019-02-22
Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 and Application Delivery Controller (ADC) 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5...
CVE-2019-9020
PUBLISHED: 2019-02-22
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc...
CVE-2019-9021
PUBLISHED: 2019-02-22
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file...
CVE-2019-9022
PUBLISHED: 2019-02-22
An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parser...
CVE-2019-9023
PUBLISHED: 2019-02-22
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcom...