1996_The_SSE-CMM.pptVIP

The Systems Security Engineering Capability Maturity Model Karen Ferraiolo Arca Systems, Inc. October 24, 1996 What you will learn: Why a CMM for Security Engineering? What is a CMM? What is the SSE-CMM? How will the SSE-CMM be used? How can I get involved? Agenda History the Need 10:30 - 10:50 Process Improvement and CMMs 10:50 - 11:10 SSE-CMM Overview 11:10 - 11:30 Using the SSE-CMM 11:30 - 11:55 Project Status 11:55 - 12:00 History and the Need What is security engineering? Security engineering, or aspects thereof, attempts to: establish a balanced set of security needs transform security needs into security guidance establish confidence in the correctness and effectiveness of security mechanisms judge that operational impacts due ro residual security vulnerabilities are tolerable integrate all aspects into a combined understanding of the trustworthiness of a system Where are we now? Security products come to market through: lengthy and expensive evaluation no evaluation Results: technology growth more rapid than its assimilation unsubstantiated security claims Causes? What is needed? continuity repeatability efficiency assurance One Potential Solution Can knowing something about the organization or individual provide a solution? Examples: ISO 9000 Certification of Information System Security Professionals (CISSP) Capability Maturity Model (CMM) Malcolm Baldridge National Quality Award Past Performance Process Improvement CMMs Process Capability Process Capability the range of expected results that can be achieved by following a process a predictor of future project outcomes Process Performance a measure of the actual results achieved from following a process (on a particular project) Statistical Process Control A process in statistical control: has definable, measurable, communicable: identity capability limits of variation are predictable however, it does not imply the absense of defective items Process Maturity extent to which process is explicitly