BSIMM14: Trends and recommendations to help improve your software security program

How security is changing

The annual BSIMM reports reflect trends in software security that are responses to the evolution of cybercrime. One of the top trends noted in BSIMM14 is increased focus on automation, as organizations are taking advantage of easy-to-use yet powerful automation available in modern toolchains to update security testing and touchpoints. This is allowing them to shift security everywhere throughout the software development life cycle (SDLC) instead of simply shifting left.

When automation makes security tasks easier, trends emerge around automated activities. Modern toolchains, for example, allow security testing in the QA stage to be automated, much like static application security testing (SAST) scans that happen earlier in the development process. Security teams that embraced the “shift everywhere” testing philosophy found that their pipelines were able to take scripted actions based on the results of those automated security tests. Firms are also using automation to better gather and use the intelligence provided by sensors throughout the SDLC to proactively prevent vulnerabilities before they become an issue for developers.

Four BSIMM software security trends

• Moving from “shift left” to “shift everywhere” continues. While the “shift left” mantra, a term coined by the BSIMM report in its early years, was meant to encourage organizations to start their security testing earlier in the SDLC, it was never meant to be taken to mean shift only left. Shift everywhere is a philosophy; it’s an approach to security governance that acknowledges the reality that consistently achieving acceptably secure software is a shared responsibility. Each stakeholder has their own business processes to execute, but each also needs to do their version of security sign-off, which requires understandable and usable telemetry from the SDLC toolchain.
• Expanding the scope of security. External pressures like government regulations and increased supply chain threats are leading organizations to extend risk management to the software that they integrate from outside sources, the toolchains used by their developers, and the software present in their operating environments.
• Implementing product-specific security. A growing number of product companies have started referring to their centralized software security effort as a product security program, rather than application or software security. This naming trend seems to correlate with product vendors creating security programs to manage the risk associated with software that exists in hostile environments for years to decades (as compared to applications in private data centers).
• Continuing to emphasize Security Champion programs. The oldest insight provided by BSIMM data is that the decision to build and operate a Security Champions program has a measurable impact on total BSIMM scores. In BSIMM14, firms with a Security Champions program scored on average 25% higher than firms without one.