Synopsys has released\u00a0BSIMM10, the latest version of the Building Security In Maturity Model (BSIMM), designed to help organisations plan, execute, mature and measure their software security initiatives (SSIs). <\/p>\n\n\n\n
Synopsys has used the BSIMM nearly 450 times across 185 firms over the\npast decade and this 10th iteration reflects software security activities\nobserved across 122 firms. <\/p>\n\n\n\n
BSIMM10 also highlights the impact of DevOps on software security\ninitiatives, the emergence of a new wave of engineering-driven security efforts\nand how firms progress through three phases of software security maturity. <\/p>\n\n\n\n
\u201cSince 2008, the BSIMM has served as an effective tool\nfor understanding how organisations of all shapes and sizes, including some of\nthe most advanced security teams in the world, are executing their software\nsecurity strategies,\u201d said Jim Routh, Head of Enterprise Information Risk\nManagement at MassMutual. <\/p>\n\n\n\n
\u201cThe current BSIMM data reflects how many organisations are adapting their approaches to address the new dynamics of modern development and deployment practices, such as shorter release cycles, increased use of automation and software-defined infrastructure.\u201d<\/p>\n\n\n\n
BSIMM10 describes the work of 7,900 software security professionals\nwhose efforts guide and maximise the security efforts of nearly 470,000\ndevelopers working on more than 173,000 applications. <\/p>\n\n\n\n
BSIMM10 represents firms in industry verticals including financial\nservices, high tech, independent software vendors (ISVs), cloud, healthcare,\nInternet of Things (IoT), insurance and retail. <\/p>\n\n\n\n
Key findings from the BSIMM10 study:<\/p>\n\n\n\n
\u201cLeading an effective software security initiative is challenging and the dramatic technological and organisational shifts brought on by DevOps and CI\/CD are not making that task easier,\u201d said Sammy Migues, Principal Scientist at Synopsys. <\/p>\n\n\n\n
\u201cAs a tool that constantly evolves to reflect the experiences of hundreds of software security groups around the world, the BSIMM and its community are invaluable resources, whether you\u2019re just beginning your journey, looking to optimise your program or grappling with new challenges.\u201d<\/p>\n\n\n\n
The BSIMM includes data collected from firms that have established real SSIs, quantifying the occurrence of 119 activities to show the common ground shared by many initiatives as well as the variations that make each initiative unique. <\/p>\n\n\n\n
The BSIMM data show that high-maturity initiatives are well-rounded, carrying out numerous activities in all 12 of the practices described by the model. Organisations can use the BSIMM to compare initiatives and determine which additional activities might be useful to support their overall strategies. <\/p>\n\n\n\n