Hi Andy, We build and then execute plans to do that kind of activity all the time at Cigital. Unfortunately, the plans are all highly tailored to the politics and operations of our specific customers, and they are proprietary.
Basically they do involve several aspects in common if you step way back and squint: * roles and responsibilities for disparate groups * a rollout plan for different touchpoints (including tools) * a portal for secdev data (guidelines, rules, tool usage data, ...) * a training program with ties to HR and advancement * legal guidance and assurance case plans for legacy and COTS software A plan for a large scale software security initiative usually encompasses activities slated to span several years. We have rolled them out in multi-national enterprises with over 10,000 developers. Measurement helps. Check out chapter 10 in "Software Security" for slightly more. Hope that helps. gem company www.cigital.com podcast www.cigital.com/silverbullet blog www.cigital.com/justiceleague book www.swsec.com On 3/11/08 12:20 PM, "Andy Murren" <[EMAIL PROTECTED]> wrote: I have been working on developing a series of documents to turn the ideas encompassed on this list and in what I can find in books & articles. I am not finding, and it may just be I am looking in the wrong places, for any information on how people are actually implementing the concepts. I have found the high level ideas (like in "Software Security" and the MS SDL) and the low level code level rules, but there does not seem to be any information on how these two are being merged and used in actual development projects. Are there any non-proprietary materials out there? If there are none, could this be part of the problem of getting secure development/design/testing/coding out into the real world? Thanks, Andy _______________________________________________ Secure Coding mailing list (SC-L) SC-L@securecoding.org List information, subscriptions, etc - http://krvw.com/mailman/listinfo/sc-l List charter available at - http://www.securecoding.org/list/charter.php SC-L is hosted and moderated by KRvW Associates, LLC (http://www.KRvW.com) as a free, non-commercial service to the software security community. _______________________________________________ _______________________________________________ Secure Coding mailing list (SC-L) SC-L@securecoding.org List information, subscriptions, etc - http://krvw.com/mailman/listinfo/sc-l List charter available at - http://www.securecoding.org/list/charter.php SC-L is hosted and moderated by KRvW Associates, LLC (http://www.KRvW.com) as a free, non-commercial service to the software security community. _______________________________________________
