Security Architecture

1) Underlying framework weakness
2) Attack resistance analysis
3) Ambiguity analysis

1) Shows dependencies on toolkits and frameworks
2) How solid is the foundation?
3) How solid is the usage of the foundation?

1) Apply checklist of known attacks
2) Risk-based judgment of fitness

1) Find attacks based on how the system works
2) Expose invalid assumptions

Building Security In Maturity Module.
The purpose of the BSIMM is to quantify the activities carried out by real software security initiatives.
BSIMM3 was published 2011

1. We relied on our own knowledge of software security practices to create the Software Security
Framework.
We conducted a series of nine in-person interviews with executives in charge of software security
initiatives.
3. We used the same interview technique to conduct thirty-three additional BSIMM assessments.

• Informed risk management decisions
• Clarity on what is “the right thing to do” for everyone involved in software security
• Cost reduction through standard, repeatable processes
• Increased code quality

A group of interested and engaged developers, architects, software managers, and testers who have a
natural affinity for software security and are catered to and leveraged by a software security initiative.

governance, intelligence, SSDL touchpoints, deployment

Those practices that help organize, manage, and measure a software security initiative. Staff development is also a central governance practice.

strategy and metrics
compliance and policy
training

Practices that result in collections of corporate knowledge used in carrying out software security activities throughout the organization. Collections include both proactive security guidance and organizational threat modeling.

Attack models
security features and design
standards and requirements

Practices associated with analysis and assurance of particular software development artifacts and processes. All software security methodologies include these practices.

Architecture analysis
code review
security testing

Practices that interface with traditional network security and software maintenance organizations. Software configuration, maintenance, and other environment issues have direct impact on software security.

penetration testing
software environment
configuration management and vulnerability management