The BSIMM data are coming soon to a website near you. Stay tuned to sc-l for an early look.
In the meantime here are the three articles that set the stage, with another under way as you read this email: A Software Security Framework: Working Towards a Realistic Maturity Model (October 15, 2008) http://www.informit.com/articles/article.aspx?p=1271382 Software Security Top 10 Surprises (December 15, 2008) http://www.informit.com/articles/article.aspx?p=1315431 Nine Things Everybody Does: Software Security Activities from the BSIMM (February 9, 2009) http://www.informit.com/articles/article.aspx?p=1326511 gem company www.cigital.com podcast www.cigital.com/silverbullet podcast www.cigital.com/realitycheck blog www.cigital.com/justiceleague book www.swsec.com On 3/3/09 10:25 AM, "Kenneth van Wyk" <k...@krvw.com> wrote: On Mar 3, 2009, at 10:11 AM, Gary McGraw wrote: > Our fearless leader Ken gave a nice presentation on software > security methodologies yesterday at secappdev. I wonder what he > says about the Touchpoints when I'm not in the room?! Thanks for the kind words. What I say about the Touchpoints, Microsoft's SDL, or OWASP's CLASP remains the same whether you're in the room or not. They all offer good points and bad points. I tend to favor a hybrid approach that works well for me, which is what I always recommend to my customers. More importantly, though, I am eager to update the message with what the companies who participated in the BSIMM are actually doing in practice. Cheers, Ken ----- Kenneth R. van Wyk KRvW Associates, LLC http://www.KRvW.com _______________________________________________ Secure Coding mailing list (SC-L) SC-L@securecoding.org List information, subscriptions, etc - http://krvw.com/mailman/listinfo/sc-l List charter available at - http://www.securecoding.org/list/charter.php SC-L is hosted and moderated by KRvW Associates, LLC (http://www.KRvW.com) as a free, non-commercial service to the software security community. _______________________________________________
