Keynote: BSIMM: A Decade of Software Security
summary
Presents a decade‑long, data‑first claim: software security becomes measurable with BSIMM: descriptive model from 67 firms (now 87), revealing surprising operational facts — about 1.4 full‑time software security people per firm trying to influence 272,000 developers — and a near 50/50 bugs vs design split. Shows tools actually used (Fortify, Coverity, IBM AppScan, FindBugs, Veracode), warns static analysis helps but doesn’t solve, and describes built outcomes: a Center for Secure Design top‑10 that Twitter uses to redesign APIs and drive cross‑site scripting counts to zero.
AI-written summary · about
chapters (19)
- 0:00Announcements and logistics
- 5:57Keynote introduction
- 10:45The history of software security
- 13:55Shifting security responsibilities
- 17:54The role of security groups
- 22:48Bugs vs. design flaws
- 27:07The evolution of static analysis
- 31:08Future security challenges
- 35:38Fixing the right bugs
- 39:27Focusing on fixing bugs
- 42:26The center for secure design
- 46:34Why security fails
- 50:16The limitations of pen testing
- 54:37The security property
- 56:51Code growth and bugs
- 1:01:00The building security in maturity model
- 1:04:38Identifying vs. fixing problems
- 1:07:20BSIMM data insights
- 1:14:01Conclusion and resources
related talks
53mOver a Decade of Software Security: What Have We Learned
22mBug Parades, Zombies and the BSIMM: A Decade of Software Security
44mKeynote: 25 Years in AppSec: Looking Back, Looking Forward
44mOpening Keynote: Prove It! Confronting Security With Data.
56mKeynote: AppSec: From Outsiders to Allies
50mFix The Damned Software
13mKeynote: Software Security: _You_ are the Calvary
40mKEYNOTE: Delivering software that is secure & usable - who’s job is it?