Health care orgs fall short on software security
Health care organizations tended to score lower than their counterparts in financial services, independent software vendors, and consumer electronics, according to Cigital’s latest Building Security in Maturity Model (BSIMM) released Monday. In its sixth iteration, the BSIMM is based on findings obtained through in-depth interviews with the most senior person in charge of software security at 104 participating organizations, as well as with all the individuals who reported to the executive. This is the first time information obtained from health care organizations was included in the model.
The model looks at software security practices in four domains: governance, intelligence, secure software development lifecycle, and deployment. Each domain has three practice areas, resulting in a dozen core segments, each of which has its own set of activities, for a total of 112 activities.
For governance, organizations can look at how they rank on compliance and policy, metrics, and training. Intelligence looks at attack models and intelligence, as well as building and publishing security features and designs. The SDLC should include elements such as security feature review and the use of automated tools as part of secure coding practices. The deployment area included penetration testing, app input monitoring, and configuration and vulnerability management.
Hiring external penetration testers to find problems was the third most popular activity, according to BSIMM.
BSIMM measures how organizations run their internal software security programs and lets organizations assess the maturity of their programs against a benchmark consisting of peers. When security professionals raise the alarm with senior executives and board members, they are frequently asked what their counterparts in the industry or other organizations of similar size are doing. The model helps organizations figure out whether they are leading the pack, in the middle, or falling behind, and it's a good starting point before figuring out what to do next, security-wise.
For example, knowing that only three organizations in the BSIMM have implemented a bug bounty program can be useful when trying to prioritize which security activities to work on next. Gary McGraw, CTO of Cigital, noted that 91 percent of BSIMM firms work with incident response teams and have established clear lines of communication. For organizations that haven't defined clear contacts and roles with incident response teams, the finding would be a sign they are not on par with other organizations.
The BSIMM is based on information from 104 enterprises, including 10 health care firms. Participating organizations include Adobe, Aetna, ANDA, The Advisory Board Company, Autodesk, Bank of America, Black Knight Financial Services, BMO Financial Group, Box, Capital One, Citigroup, Cisco, Comerica, Cryptography Research, Depository Trust and Clearing Corporation, Elavon, EMC, Epsilon, Experian, Fannie Mae, Fidelity, F-Secure, HP Fortify, HSBC, Intel Security, JPMorgan Chase, Lenovo, LinkedIn, Marks & Spencer, McKesson, NetApp, NetSuite, Neustar, Nokia, PayPal, Pearson Learning Technologies, Qualcomm, Rackspace, Salesforce, Siemens, Sony Mobile, Symantec, Home Depot, Trainline, TomTom, U.S. Bancorp, Vanguard, Visa, VMware, Wells Fargo, and Zephyr Health. This was also the first time consumer electronics companies that work with the Internet of things were included in the model.
“BSIMM continues to be the authoritative source of observed practices and activities from the most mature software security programs across industries,” said Jim Routh, the chairman of NH-ISAC.