Organizational benchmarking body the CMMI Institute has extended the eponymously named development framework to address security concerns in software and systems development.
An August 2013 study of Ponemon Institute and Security Innovation found that "most software development organizations" (and by that presumably they include teams of all sizes up and down the land) do not consider security in the development process, leaving the end applications and products vulnerable.
CMMI for Development is a framework of practices designed to improve quality and reliability in development processes, and many users have included security efforts in CMMI adoptions.
This update claims to addresses security in a new way, with a set of practices "explicitly designed" to include security concerns in CMMI adoption and appraisals.
With the release of a technical report entitled "Security by Design with CMMI for Development V1.3: An Application Guide for Improving Processes for Secure Products", the CMMI framework is extended to include guidelines for including security requirements as quality criteria in the development process.
Specific new process areas include Organizational Preparedness for Secure Development, Security Management in Projects, Security Requirements and Technical Solution, and Security Verification and Validation.
"We understand that security issues concern every level of the technology-centered enterprise," said Kirk Botula, CEO, CMMI Institute. "At the institute, we are actively seeking ways to help CMMI users tailor the frameworks to best meet their organization's business goals. We are pleased to help organizations to develop operational resiliency against attacks by creating sustainable methods for developing secure products."
