The Software Security Framework (SSF)
The table below is a clickable version of the Software Security Framework. There are twelve practices organized into the four domains of Governance, Intelligence, SSDL Touchpoints, and Deployment. Click on a domain to see its description below. The 12 practices are used to organize the 111 BSIMM activities. Click on a practice to see both its "skeleton" and the details for all activities it contains. Note that all examples given in activity descriptions are real examples drawn from field observation.
Governance: Those practices that help organize, manage, and measure a software security initiative. Staff development is also a central governance practice.
In the governance domain, the strategy and metrics practice encompasses planning, assigning roles and
responsibilities, identifying software security goals, determining budgets, and identifying metrics and gates.
The compliance and policy practice is focused on identifying controls for compliance regimens such as PCI
DSS and HIPAA, developing contractual controls such as Service Level Agreements to help control COTS
software risk, setting organizational software security policy, and auditing against that policy. Training has
always played a critical role in software security because software developers and architects often start with
very little security knowledge.
Intelligence: Practices that result in collections of corporate knowledge used in carrying out software security activities throughout the organization. Collections include both proactive security guidance and organizational threat modeling.
The intelligence domain is meant to create organization-wide resources. Those resources are divided into three
practices. Attack models capture information used to think like an attacker: threat modeling, abuse case
development and refinement, data classification, and technology-specific attack patterns. The security features
and design practice is charged with creating usable security patterns for major security controls (meeting the
standards defined in the next practice), building middleware frameworks for those controls, and creating and
publishing other proactive security guidance. The standards and requirements practice involves eliciting explicit
security requirements from the organization, determining which COTS to recommend, building standards for
major security controls (such as authentication, input validation, and so on), creating security standards for
technologies in use, and creating a standards review board.
SSDL Touchpoints: Practices associated with analysis and assurance of particular software development artifacts and processes. All software security methodologies include these practices.
The SSDL Touchpoints domain is probably the most familiar of the four. This domain includes essential
software security best practices that are integrated into the SDLC. The two most important software
security practices are architecture analysis and code review. Architecture analysis encompasses capturing
software architecture in concise diagrams, applying lists of risks and threats, adopting a process for review
(such as STRIDE or Architectural Risk Analysis), and building an assessment and remediation plan for
the organization. The code review practice includes use of code review tools, development of tailored
rules, customized profiles for tool use by different roles (for example, developers versus auditors), manual
analysis, and tracking/measuring results. The security testing practice is concerned with pre-release testing
including integrating security into standard quality assurance processes. The practice includes use of black
box security tools (including fuzz testing) as a smoke test in QA, risk driven white box testing, application
of the attack model, and code coverage analysis. Security testing focuses on vulnerabilities in construction.
Deployment: Practices that interface with traditional network security and software maintenance organizations. Software configuration, maintenance, and other environment issues have direct impact on software security.
By contrast, in the deployment domain, the penetration testing practice involves more standard outside→in
testing of the sort carried out by security specialists. Penetration testing focuses on vulnerabilities in final
configuration, and provides direct feeds to defect management and mitigation. The software environment
practice concerns itself with OS and platform patching, Web application firewalls, installation and configuration
documentation, application monitoring, change management, and ultimately code signing. Finally, the
configuration management and vulnerability management practice concerns itself with patching and updating
applications, version control, defect tracking and remediation, and incident handling.
