Building Security In Maturity Model offers best practices from the real world

Dark Reading Staff, Dark Reading

March 14, 2009

1 Min Read

A group of software experts has published a battle-tested set of best practices for secure software development that it hopes will be widely adopted by programmers.

The Building Security In Maturity Model (BSIMM) is a collection of 110 activities discovered during an extensive study of nine organizations that are recognized as being highly effective in building secure software. It was developed largely by two security tools vendors, Cigital and Fortify, but it has been vetted and reviewed by many software development organizations, the creators say.

"BSIMM is a real-world set of software security activities organized so that you can determine where you stand with your software security initiative and how to evolve your initiative over time," the group says. "BSIMM describes the set of activities practiced by nine of the most successful software security initiatives in the world. In that sense, it is a de facto standard because it's what organizations actually do. You could say we discovered it, rather than dreamed it up."

The BSIMM effort has received praise from those who have reviewed and participated in its development, including Microsoft. It's a free download, with the only requirement that if developers use it, they must point back to it in their documentation.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights