{"id":12,"date":"2024-02-12T08:16:23","date_gmt":"2024-02-12T08:16:23","guid":{"rendered":"http:\/\/williamlien.com\/index.php\/2024\/02\/12\/the-importance-of-security-knowledge-sharing-2\/"},"modified":"2024-02-13T13:44:00","modified_gmt":"2024-02-13T13:44:00","slug":"the-importance-of-security-knowledge-sharing-2","status":"publish","type":"post","link":"https:\/\/williamlien.com\/index.php\/2024\/02\/12\/the-importance-of-security-knowledge-sharing-2\/","title":{"rendered":"My Journey with the BSIMM Framework: Lessons Learned and Success"},"content":{"rendered":"<p>The Building Security In Maturity Model (BSIMM) is a powerful tool that organizations can use to assess the maturity of their software security initiatives. It&#8217;s not just a theoretical model\u2014it&#8217;s based on the real-world practices of top companies. I was fortunate enough to be involved in leading our company&#8217;s BSIMM assessments in 2021 and 2022. Through these assessments, we saw measurable improvement in our approach to software security. In this blog post, I&#8217;ll share our experience with the BSIMM and offer tips for others leveraging this valuable framework.<\/p>\n<h2>Understanding the BSIMM<\/h2>\n<p>The BSIMM provides a data-driven view of what other organizations are doing when it comes to software security. It breaks down software security practices into 12 key areas<\/p>\n<p><strong>Governance<\/strong><\/p>\n<ul>\n<li>Strategy &amp; Metrics<\/li>\n<li>Compliance &amp; Policy<\/li>\n<li>Training<\/li>\n<\/ul>\n<p><strong>Intelligence<\/strong><\/p>\n<ul>\n<li>Attack Models<\/li>\n<li>Security Features &amp; Design<\/li>\n<li>Standards &amp; Requirements<\/li>\n<\/ul>\n<p><strong>SSDL Touchpoints<\/strong><\/p>\n<ul>\n<li>Architecture Analysis<\/li>\n<li>Code Review<\/li>\n<li>Security Testing<\/li>\n<\/ul>\n<p><strong>Deployment<\/strong><\/p>\n<ul>\n<li>Penetration Testing<\/li>\n<li>Software Environment<\/li>\n<li>Config Mgmnt \/ Vuln Mgmnt<\/li>\n<\/ul>\n<p>The BSIMM helps you prioritize your software security efforts by showing you where you are today and where you could realistically be within a specific timeframe.<\/p>\n<h2>Our BSIMM Experience<\/h2>\n<p>When we started our first BSIMM assessment in 2021, we learned a lot about where we stood and quickly identified areas we could improve on. By conducting another BSIMM assessment in 2022, we were able to track our progress and celebrate our successes.<\/p>\n<h2>BSIMM Success Tips<\/h2>\n<p data-sourcepos=\"38:1-38:94\">If you&#8217;re thinking about using the BSIMM framework, here are a few tips to smooth the process:<\/p>\n<ul data-sourcepos=\"40:1-43:0\">\n<li data-sourcepos=\"40:1-40:123\"><strong>Gain Executive Buy-in:<\/strong>\u00a0Support from executives is critical for driving improvement after identifying gaps with BSIMM.<\/li>\n<li data-sourcepos=\"41:1-41:135\"><strong>Be Patient:<\/strong>\u00a0It takes time to build and nurture an effective software security program. Expect a journey, not an overnight result.<\/li>\n<li data-sourcepos=\"42:1-43:0\"><strong>Celebrate Your Wins:<\/strong>\u00a0Software security progress can be incremental; it&#8217;s essential to recognize smaller successes along with major milestones.<\/li>\n<\/ul>\n<h2 data-sourcepos=\"44:1-44:15\"><strong>Wrapping Up<\/strong><\/h2>\n<p data-sourcepos=\"46:1-46:249\">Using the BSIMM framework, you can make concrete changes in your software security posture over time. The model doesn&#8217;t offer just a snapshot; it gives you a structured, measurable way to drive a successful and evolving software security initiative.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Building Security In Maturity Model (BSIMM) is a powerful tool that organizations can use to assess the maturity of their software security initiatives. It&#8217;s not just a theoretical model\u2014it&#8217;s based on the real-world practices of top companies. I was fortunate enough to be involved in leading our company&#8217;s BSIMM assessments in 2021 and 2022. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":41,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-12","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/williamlien.com\/index.php\/wp-json\/wp\/v2\/posts\/12","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/williamlien.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/williamlien.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/williamlien.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/williamlien.com\/index.php\/wp-json\/wp\/v2\/comments?post=12"}],"version-history":[{"count":1,"href":"https:\/\/williamlien.com\/index.php\/wp-json\/wp\/v2\/posts\/12\/revisions"}],"predecessor-version":[{"id":43,"href":"https:\/\/williamlien.com\/index.php\/wp-json\/wp\/v2\/posts\/12\/revisions\/43"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/williamlien.com\/index.php\/wp-json\/wp\/v2\/media\/41"}],"wp:attachment":[{"href":"https:\/\/williamlien.com\/index.php\/wp-json\/wp\/v2\/media?parent=12"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/williamlien.com\/index.php\/wp-json\/wp\/v2\/categories?post=12"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/williamlien.com\/index.php\/wp-json\/wp\/v2\/tags?post=12"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}