The BSIMM is now on its ninth iteration. But what was the motivation behind its genesis?
It all started around 2006 when multiple software security methodologies began springing up like mushrooms after a spring rain. Gary McGraw and Sammy Migues of Synopsys Software Integrity Group (then of Cigital) noticed that these methodologies had one key thing in common—they were based on opinion, not fact.
After debating a solution for some time, Gary and Sammy, along with Brian Chess (then of Fortify), began to develop a descriptive model stating what software security people were actually doing, instead of what they “ought to be doing.”
To start, Gary, Sammy, and Brian selected nine firms that were very advanced in software security to be part of their scientific study. The three spent many hours and lots of airplane miles gathering data, conducting a series of in-person interviews, and developing a model that described the data. From this work sprung the first BSIMM, published in 2009.
Because the original data-driven, descriptive approach taken by the BSIMM was designed to be adaptive, the BSIMM has been adjusted over the years to cohere with the data. In general, the model has remained consistent over nine iterations. The purpose of the model also has remained the same: describe what is happening in software security initiatives, rather than prescribe what “should happen” based on opinion alone.