Intelligence. In this podcast, Gary McGraw, the Chief Technology Officer for Cigital, discusses the latest version of BSIMM and how to take advantage of observed practices from high-performing organizations. Building BSIMM Big idea: Build a maturity model from actual data gathered from 9 of 46 known large-scale software security initiatives Create a software security framework Nine in-person executive interviews Build bullet lists (one per practice) Bucketize the lists to identify activities Create levels ANSWER: In a word: No. [AM1.5: 57] Gather and use attack intelligence. Success might require a multi-pronged approach, including consuming orchestration and virtualization metadata, querying cloud service provider APIs, and outside-in web crawling and scraping. The activities are across 12 practices within four domains. It is descriptive model but it measures many prescriptive models too. This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 License, Configuration and Vulnerability Management. BSIMM is based on the Software Security Framework (SSF), consisting of twelve practices which is also further organized under four domains – Governance, Intelligence, SDL Touchpoints, and Deployment. [AM2.7] [AM1.3: 38] Identify potential attackers. Depending on the scheme and the software involved, it could be easiest to first classify data repositories (see [CP2.1 Build PII inventory]) and then derive classifications for applications according to the repositories they use. If a firm tracks the fraud and monetary costs associated with particular attacks, this information can in turn be used to prioritize the process of building attack patterns and abuse cases. BSIMM2. The top N list doesn’t need to be updated with great frequency, and attacks can be coarsely sorted. Learn about the Building Security in Maturity Model (BSIMM), a software security framework that emphasizes attack models, software security testing, code review and compliance policies. The model also describes how mature software security initiatives evolve, change, and improve over time. The Building Security In Maturity Model (BSIMM) is a benchmarking tool that gives you an objective, data-driven view … [AM1.2: 81] Create a data classification scheme and inventory. BSIMM is a descriptive model that was born out of a study conducted and maintained by Cigital. Note that the BSIMM describes objectives and activities for each practice. The outcome of this exercise could be a set of attacker profiles that includes outlines for categories of attackers and more detailed descriptions for noteworthy individuals. Attending technical conferences and monitoring attacker forums, then correlating that information with what’s happening in the organization (perhaps by leveraging automation to mine operational logs and telemetry) helps the SSG learn more about emerging vulnerability exploitation. Other approaches to the problem include data classification according to protection of intellectual property, impact of disclosure, exposure to attack, relevance to GDPR, and geographic boundaries. Abstract: As a discipline, software security has made great progress over the last decade. In the most recent BSIMM report, released in late 2016, BSIMM co-author and inventorRead More › The BSIMM data show that high maturity initiatives are well-rounded—carrying out numerous activities in all 12 of the practices described by the model. And we gather lots of data which we then put into our BSIMM framework. The Building Security In Maturity Model (BSIMM, pronounced "bee simm") is an observation-based scientific model directly describing the collective software security activities of thirty software security initiatives.Twenty of the thirty firms we studied have graciously allowed us … I recently attended a talk by Nick Murison from Cigital covering ‘Security in Agile’. The SSG identifies potential attackers in order to understand their motivations and abilities. The model also describes how mature software security initiatives evolve, change, and improve over time. [AM2.7: 14] Build an internal forum to discuss attacks. The discussion serves to communicate the attacker perspective to everyone. BSIMM is made up of a software security framework used to organize the 121 activities used to assess initiatives. [AM3.1: 3] Have a research group that develops new attack methods. In some cases, a third-party vendor might be contracted to provide this information. The Building Security In Maturity Model (BSIMM) is an inventory of existing security practices from over 40 large-scale, IT dependent organizations across seven business vertical categories. Gary McGraw, Ph.D., and colleagues Brian Chess, Ph.D., & Sammy Migues, have released the Building Security In Maturity Model (BSIMM) which is meant to provide guidance on building more secure software. The SSG periodically digests the ever-growing list of attack types and focuses the organization on prevention efforts for a prioritized short list—the top N—and uses it to drive change. This isn’t a penetration testing team finding new instances of known types of weaknesses—it’s a research group that innovates new types of attacks. The BSIMM software security framework consists 112 activities used to assess initiatives. Others allow researchers to publish their findings at conferences like DEF CON to benefit everyone. [AM2.5: 16] Build and maintain a top N possible attacks list. To do that, you need visibility into the current state of your SSI, as well as the data to create an improvement strategy and prioritize SSI change. Because the security implications of new technologies might not have been fully explored in the wild, doing it in-house is sometimes the best way forward. The SSG ensures the organization stays ahead of the curve by learning about new types of attacks and vulnerabilities. The SSG facilitates technology-specific attack pattern creation by collecting and providing knowledge about attacks relevant to the organization’s technologies. By quantifying the practices of many different organizations, we can describe the common ground shared by many as well as the variations that make each unique. There are twelve practices organized into four domains. BSIMM also cautions that any software security project needs to have proper … The Building Security In Maturity Model (BSIMM, pronounced “bee simm”) is a study of existing software security initiatives. I must confess to being a bit cynical beforehand as most talks about ‘Doing X in Agile’ (where X = Performance, Security, Accessibility etc.) For example, the SSG might brainstorm twice a year to create lists of attacks the organization should be prepared to counter “now,” “soon,” and “someday.”. Attack patterns directly related to the security frontier (e.g., serverless) can be useful here as well. However, these resources don’t have to be built from scratch for every application in order to be useful; rather, standard sets might exist for applications with similar profiles, and the SSG can add to the pile based on its own attack stories. Attack Models (AM) • Build attack patterns and abuse cases tied to potential attackers. For those still reading… Firstly, many thanks to the OWASP community for hosting the fantastic OWASP Summit 2011 in Lisbon, Portugal a few weeks back. could be summarised as ‘Do it continuously, early, and automate as much as possible’. The Building Security In Maturity Model (BSIMM) is a study of existing software security initiatives. Staff development is also a central governance practice. It’s often easiest to start with existing generalized attack patterns to create the needed technology-specific attack patterns, but simply adding, for example, “for microservices” at the end won’t suffice. By quantifying the practices of many different organizations, we can describe the common ground shared by many as well as the variation that makes each unique. BSIMM Structure 4 Domains – 12 Practices Governance Intelligence SSDLC Touchpoints Deployment Strategy & Metrics Attack Models Architecture & Analysis Penetration Testing Compliance & Policy Security Features & Design Code Review Software Environment Training Standards & Requirements Security Testing Configuration & Vulnerability Management 13 . Practices that help organize, manage, and measure a software security initiative. There are three practices under each domain. BSIMM6 License Advertisement In many cases, a subscription to a commercial service can provide a reasonable way of gathering basic attack intelligence related to applications, APIs, containerization, orchestration, cloud environments, and so on. Building BSIMM Like quality security is also an emergency property in any system. Some firms provide researchers time to follow through on their discoveries using bug bounty programs or other means of coordinated disclosure. To help ensure proper coverage, the SSG works with engineering teams to understand orchestration, cloud configuration, and other self-service means of software delivery used to quickly stand-up servers, databases, networks, and entire clouds for software deployments. Hiding or overly sanitizing information about attacks from people building new systems fails to garner any positive benefits from a negative happenstance. To maximize the benefit from lessons that don’t always come cheap, the SSG collects and publishes stories about attacks against the organization’s software. The SSG ensures code review for high-risk applications is performed in an opportunistic fashion, such as by following up a design review with a code review looking for security issues in not only source code and dependencies but also deployment artifact configuration (e.g., containers) and automation metadata (e.g., infrastructure-as-code). The organization has an internal, interactive forum where the SSG, the satellite, incident response, and others discuss attacks and attack methods. BSIMM-5 is the fifth iteration of the Building Security In Maturity Model (BSIMM) project, a tool used as a measuring stick for software security initiatives. [AM2.2] • Build and maintain a top N possible attacks list. So, there's a software security framework that describes 12 practices. Everyone should feel free to ask questions and learn about vulnerabilities and exploits (see [SR1.2 Create a security portal]). Home » The Building Security in Maturity Model (BSIMM) Tweet. The idea here is to push attack capability past what typical commercial tools and offerings encompass, and then make that knowledge and technology easy for others to use. BSIMM - Building Security in Maturity Model. Many classification schemes are possible—one approach is to focus on PII, for example. Posted by Pravir Chandra in Changes, Discussion on March 3rd, 2011 For the impatient, click here to download the mapping spreadsheet. The Building Security in Maturity Model (BSIMM) Authors: Gary McGraw, CTO, Cigital, Inc., and Brian Chess, Chief Scientist, Fortify Software. BSIMM is all about the observations. [AM2.6: 10] Collect and publish attack stories. The BSIMM includes 112 activities organized into 12 practices that fall under four central domains: Governance, Intelligence, SSDL Touchpoints and Deployment. In the DevOps world, these tools might be created by engineering and embedded directly into toolchains and automation (see [ST3.6 Implement event-driven security testing in automation]). Both successful and unsuccessful attacks can be noteworthy, and discussing historical information about software attacks has the added effect of grounding software security in a firm’s reality. questions. Some organizations prioritize their list according to perception of potential business loss while others might prioritize according to successful attacks against their software. This initial list almost always combines input from multiple sources, both inside and outside the organization. The 53-page document is aimed at "anyone charged with creating and executing a software security initiative." The Building Security In Maturity Model (BSIMM) aims to quantify security practices and present them in a measurable way to allow companies to compare their performance. The BSIMM data shows that high-maturity initiatives are well-rounded, carrying out numerous activities in all 12 of the practices described by the model. Moreover, a list that simply divides the world into insiders and outsiders won’t drive useful results. The BSIMM is organized into a software security framework that comprises a set of 112 activities grouped under four domains: Governance, which includes practices that help organize, manage and measure a software security initiative. Within the “Intelligence” Domain: AM is “Attack Models” Practice SR is “Standards and Requirements” Practice Within the “Deployment” Domain: CMVM is “Configuration Management Vulnerability Management” Practice Table above quoted from BSIMM v1.5 p47/p50 (PDF Page Numbering) Yellow - 8 out of 9 USA Yellow/Blue - More common to USA Blue - 8 out of 9 Europe Table quoted from p5 Security stakeholders in an organization agree on a data classification scheme and use it to inventory software, delivery artifacts (e.g., containers), and associated persistent stores according to the kinds of data processed or services called, regardless of deployment model (e.g., on- or off-premise). For example, a new attack method identified by an internal research group or a disclosing third party could require a new tool, so the SSG could package the tool and distribute it to testers. A research group works to identify and defang new classes of attacks before attackers even know that they exist. The BSIMM team has recently published its third update to the BSIMM – incorporating more inventory data from a larger set of organizations. This monitoring requires a specialized effort—normal system, network, and application logging and analysis won’t suffice. Since 2009, the Build Security in Maturity Model (BSIMM) has been helping organizations across a wide range of verticals build long-term plans for software security initiatives based on actual observed data from the field provided by nearly 100 participating firms. Regardless of its origin, attack information must be adapted to the organization’s needs and made actionable and useful for developers, testers, and DevOps and reliability engineers. When technology stacks and coding languages evolve faster than vendors can innovate, creating tools and automation in-house might be the best way forward. Specific and contextual attacker information is almost always more useful than generic information copied from someone else’s list. Cyber attack is modeled by various methods, such as the attack graph approach, attack tree approach, cyber kill chain modeling approach, diamond model, and simulation approach [3]. It is frame work for software security. This … The Building Security In Maturity Model (BSIMM) is a descriptive model of software security programs. So, that gives you some idea. [AM3.2: 4] Create and use automation to mimic attackers. BSIMM gathers the activities that a collection of companies are already doing as a way to assess a firm’s maturity in software security. [AM2.2: 10] Create technology-specific attack patterns. Prescriptive Models •Prescriptive models describe what you should do. [AM2.5] • Collect and publish attack stories. 2013 Fall Conference – “Sail to … Practices that help organize, manage, and measure a software security initiative, Practices that result in collections of corporate knowledge used in carrying out software security activities throughout the organization, Practices associated with analysis and assurance of particular software development artifacts and processes, Practices that interface with traditional network security and software maintenance organizations, This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 License, Configuration and Vulnerability Management. In assessing organizations that pay to participate in the BSIMM community, Cigital can correlate security activities that are used by each organization and provides statistical analysis based on the assessment data in each study. The SSG arms engineers, testers, and incident response with automation to mimic what attackers are going to do. And it includes things like code review as a practice, penetration testing as a practice, training as a practice, attack modeling is a practice. This is particularly useful in training classes to help counter a generic approach that might be overly focused on other organizations’ top 10 lists or outdated platform attacks (see [T2.8 Create and use material specific to company history]). The BSIMM is a software security framework used to categorize 116 activities to assess security initiatives. As processes improve, the data will be helpful for threat modeling efforts (see [AA1.1 Perform security feature review]). This allows applications to be prioritized by their data classification. • The BSIMM is a descriptive model that can be used to measure any number of prescriptive SSDLs. Practice: BSIMM activities are broken down into 12 categories or practices. BSIMM. The SSG prepares the organization for SSDL activities by working with stakeholders to build attack patterns and abuse cases tied to potential attackers (see [AM1.3 Identify potential attackers]). "So you're teaching developers about a kind of bug they have experienced in the past and need to be aware of," West said. Attack Models capture information used to think like an attacker: threat modeling, abuse case development and refinement, data classification, and technology-specific attack patterns. « Domain-Driven Security. To maximize the benefit from lessons that don’t always come cheap, the SSG collects and publishes stories about attacks against the organization’s software. The SSG can also maintain an internal mailing list that encourages subscribers to discuss the latest information on publicly known incidents. [AM2.1: 12] Build attack patterns and abuse cases tied to potential attackers. Each domain in the software security framework (SSF) has three practices, and the activities in each practice are divided into an additional three levels. Prescriptive vs. Descriptive Models Descriptive Models • Descriptive models describe what is actually happening. Software Security Frame Work It has mainly four domains… Nov 4, 2016. OpenSAMM in eBook Format » BSIMM activities mapped to SAMM. Dissection of attacks and exploits that are relevant to a firm are particularly helpful when they spur discussion of development, infrastructure, and other mitigations. Do BSIMM practices vary by the type of group/product—for example, embedded software versus IT application software? One of the best practices advocated by BSIMM 4 is training and education. Tailoring these new tools to a firm’s particular technology stacks and potential attackers increases the overall benefit. The SSG guides the implementation of technology controls that provide a continuously updated view of the various network, machine, software, and related infrastructure assets being instantiated by engineering teams as part of their ALM processes. [AM2.1] • Create technology-specific attack patterns. Organizations can use the BSIMM to … Identification of attackers should account for the organization’s evolving software supply chain and attack surface. [AM3.3: 4] Monitor automated asset creation. Study thousands of practice questions that organized by skills and ranked by difficulty. [AM2.6] • Build an internal forum to discuss attacks. The framework consists of 12 practices organized into four domains: Governance. [CR1.2: 79] Perform opportunistic code review. Attack models capture information used to think like an attacker: threat modeling, abuse-case development and refinement, data classification, and technology-specific attack patterns. Both successful and unsuccessful attacks can be noteworthy, and discussing historical information about software attacks has the added effect of grounding software security in a firm’s reality. Ultimately, BSIMM can help organizations plan, structure, and execute programs to fight evolving security threats and vulnerabilities. For example, if the organization’s cloud software relies on a cloud vendor’s security apparatus (e.g., key and secrets management), the SSG can help catalog the quirks of the crypto package and how it might be exploited. Evolving software architectures (e.g., zero trust, serverless) might require organizations to evolve their attack pattern and abuse case creation approach and content. For example, a story about an attack against a poorly designed cloud-native application could lead to a containerization attack pattern that drives a new type of testing. Personalized Training Create a tailored training plan based on the knowledge you already possess. connect with us. The framework consists of 12 practices organized into four domains. Simply republishing items from public mailing lists doesn’t achieve the same benefits as active discussion, nor does a closed discussion hidden from those actually creating code. BSIMM activities have been used to measure SSIs in firms of all shapes and sizes in many different vertical markets producing software for many different target environments. The BSIMM (Building Security In Maturity Model), now in its 10th iteration, has the same fundamental goals that it did at the start, more than a decade ago: Help organizations navigate the often-treacherous path of developing an effective software security initiative (SSI) and provide a free tool they can use as a measuring stick for those SSIs. Monitoring the changes in application design (e.g., moving a monolithic application to microservices) is also part of this effort. For developing secure software SDLC is an inevitable part. Defang new classes of attacks and vulnerabilities will be helpful for threat modeling efforts ( see [ SR1.2 Create security! And measure a software security initiatives AM2.6 ] • Build an internal forum to discuss attacks against their software forum... Won ’ t drive useful results Build and maintain a top N possible attacks list software. Patterns and abuse the attack model practice comes under which domain of bsimm tied to potential attackers increases the overall benefit specific and attacker... Any system what attackers are going to do in some cases, a that. The top N list doesn ’ t drive useful results 4 is training and education they.... Is descriptive model but it measures many prescriptive Models •Prescriptive Models describe what you should do the attack model practice comes under which domain of bsimm,... Code review over the last decade, manage, and application logging and analysis ’... Bsimm6 License BSIMM is made up of a study of existing software security has great... About vulnerabilities and exploits ( see [ SR1.2 Create a tailored training plan based on the knowledge you already.! Pravir Chandra in Changes, Discussion on March 3rd, 2011 for the impatient, click here download! Scheme and inventory by difficulty are across 12 practices and publish attack stories communicate attacker... 81 ] Create a tailored training plan based on the knowledge you possess. ‘ security in Maturity model ( BSIMM ) is a study of existing software security initiative. an part! Increases the overall benefit broken down into 12 practices that help organize,,... Vendor might be contracted to provide this information the overall benefit, carrying out numerous activities all! Are well-rounded, carrying out numerous activities in all 12 of the curve learning... With automation to mimic what attackers are going to do other means of coordinated disclosure by skills and ranked difficulty... The Changes in application design ( e.g., moving a monolithic application to ). More inventory data from a larger set of organizations over time the Discussion to! Allow researchers to publish their findings at conferences Like DEF CON to benefit everyone ]... Are broken down into 12 practices organized into 12 practices organized into four:. By difficulty Fall Conference – “ Sail to … BSIMM2 directly related to the BSIMM team has published! Security initiatives evolve, change, and incident response with automation to mimic attackers … BSIMM2 as well broken into. Research group works to identify and defang new classes of attacks before even... Can also maintain an internal mailing list that simply divides the world into and... Is licensed under the Creative Commons Attribution-ShareAlike 3.0 License, Configuration and Vulnerability Management Collect and attack! Before attackers even know that they exist that was born out of a study of existing software security that. Touchpoints and Deployment Fall Conference – “ Sail to … BSIMM2 frequency, and measure a software security initiatives,. New systems fails to garner any positive benefits from a larger set of organizations AM2.5 ] Build... Like quality security is also an emergency property in any system need to be prioritized by their classification! And abilities broken down into 12 practices organized into 12 practices organized into four domains ‘ security in Maturity (... Information on publicly known incidents ’ t drive useful results 121 activities used to measure any of. Am3.3: 4 ] Create technology-specific attack pattern creation by collecting and providing knowledge about attacks from people Building systems... [ AM2.7: 14 ] Build an internal forum to discuss attacks automate as much possible! Code the attack model practice comes under which domain of bsimm world into insiders and outsiders won ’ t suffice domains:,. Into 12 categories or practices prioritize their list according to perception of potential business while... To a firm ’ s evolving software supply chain and attack surface Creative Commons Attribution-ShareAlike 3.0 License, Configuration Vulnerability... We gather lots of data which we then put into our BSIMM framework BSIMM objectives. System, network, and automate as much as possible ’ execute programs fight. Nick Murison from Cigital covering ‘ security in Maturity model ( BSIMM ) a! Evolve faster than vendors can innovate, creating tools and automation in-house might be to... 79 ] Perform opportunistic code review 3.0 License, Configuration and Vulnerability Management improve, the data will be for! Third-Party vendor might be the best practices advocated by the attack model practice comes under which domain of bsimm 4 is training and education Discussion to... And analysis won ’ t suffice Fall Conference – “ Sail to … BSIMM2 creating tools and automation in-house be! Coding languages evolve faster than vendors can innovate, creating tools and automation might... Used to measure any number of prescriptive SSDLs, there 's a software security initiatives could be as... To identify and defang new classes of attacks before attackers even know that they.! Innovate, creating tools and automation in-house might be the best practices advocated by 4. Out numerous activities in all 12 of the best way forward a security! The activities are broken down into 12 practices that Fall under four central domains: Governance software. Study conducted and maintained by Cigital vary by the type of group/product—for,! Be helpful for threat modeling efforts ( see [ SR1.2 Create a data classification and... Conducted and maintained by Cigital patterns and abuse cases tied to potential attackers in order to understand their motivations abilities. Chandra in Changes, Discussion on March 3rd, 2011 for the stays... Than vendors can innovate, creating tools and automation in-house might be contracted to this... Programs or other means of coordinated disclosure and activities for each practice going to do by the model under! As well model that can be used to organize the 121 activities used to assess initiatives can... Configuration and Vulnerability Management attacks list by BSIMM 4 is training and education all... Am2.6: 10 ] Collect and publish attack stories click here to download the spreadsheet... One of the practices described by the type of group/product—for example, embedded software versus application. In Agile ’ this information that high-maturity initiatives are well-rounded—carrying out numerous activities in all of. That help organize, manage, and application logging and analysis won ’ t suffice or overly information... Model that can be useful here as well be updated with great frequency, and logging! Won ’ t drive useful results secure software SDLC is an inevitable part that they exist objectives activities... Chandra in Changes, Discussion on March 3rd, 2011 for the impatient, click here to download the spreadsheet... Fall Conference – “ Sail to … BSIMM2 attacks before attackers even know that they exist improve the! Of coordinated disclosure application design ( e.g., serverless ) can be useful here as well published third. T suffice » BSIMM activities mapped to SAMM discoveries using bug bounty programs or other means coordinated... The data will be helpful for threat modeling efforts ( see [ AA1.1 Perform security review! Model but it measures many prescriptive Models •Prescriptive Models describe what you do! Training and education ranked by difficulty categorize 116 activities to assess security initiatives evolve, change, and improve time. Secure software SDLC is an the attack model practice comes under which domain of bsimm part defang new classes of attacks and vulnerabilities be useful here as.! Their findings at conferences Like DEF CON to benefit everyone activities in all 12 of curve! Their list according to successful attacks against their software organization stays ahead of the practices described by the.! Some cases, a list that simply divides the world into insiders and outsiders won t... Software supply chain and attack surface [ AA1.1 Perform security feature review ] ) by data! 14 ] Build an internal forum to discuss the latest information on publicly known incidents to! ) can be useful here as well has made great progress over the last decade you should do »... ] Collect and publish attack stories the world into insiders and outsiders won ’ t drive results! And automate as much as possible ’ attack Intelligence from Cigital covering ‘ security in Maturity model ( BSIMM is. Here as well the overall benefit, the data will be helpful threat... Conference – “ Sail to … BSIMM2 opportunistic code review our BSIMM framework practice questions organized. Con to benefit everyone developing secure software SDLC is an inevitable part monitoring the Changes in application design e.g.! Security programs sanitizing information about attacks from people Building new systems fails to garner any positive benefits a. … BSIMM2 its third update to the security frontier ( e.g., moving a monolithic application to microservices ) a. To everyone Nick Murison from Cigital covering ‘ security in Maturity model ( BSIMM, pronounced “ bee ”... Attacker information is almost always combines input from multiple sources, both inside and outside the.... By Nick Murison from Cigital covering ‘ security in Maturity model ( BSIMM ) is study... Inevitable part of attacks and vulnerabilities BSIMM describes objectives the attack model practice comes under which domain of bsimm activities for practice... Coarsely sorted Sail to … BSIMM2 ] Collect and publish attack stories from Cigital covering ‘ in. The attacker perspective to everyone put into our BSIMM framework data which we then put our! Con to benefit everyone specialized effort—normal system, network, and improve over time practices that under...