A recent study confirmed what security professionals have long suspected: the healthcare sector lags behind other high-visibility industry sectors regarding software security. The number of health care breaches, including US-based Anthem and Premera Health this year alone, hint at underlying issues in software security practices.
Healthcare organisations tended to score lower than their counterparts in financial services, independent software vendors, and consumer electronics, according to Cigital’s latest Building Security in Maturity Model (BSIMM). In its sixth iteration, the BSIMM is based on findings obtained through in-depth interviews with the most senior person in charge of software security at 104 participating organisations, as well as with all the individuals who reported to the executive. This is the first time information obtained from health care organisations was included in the model.
The model looks at software security practices in four domains: governance, intelligence, secure software development lifecycle, and deployment. Each domain has three practice areas, resulting in a dozen core segments, each of which has its own set of activities, for a total of 112 activities.
Governance
For governance, organisations can look at how they rank on compliance and policy, metrics, and training. Intelligence looks at attack models and intelligence, as well as building and publishing security features and designs. The SDLC should include elements such as security feature review and the use of automated tools as part of secure coding practices. The deployment area included penetration testing, app input monitoring, and configuration and vulnerability management.
Hiring external penetration testers to find problems was the third most popular activity, according to BSIMM.
BSIMM measures how organisations run their internal software security programmes and lets organisations assess the maturity of their programmes against a benchmark consisting of peers. When security professionals raise the alarm with senior executives and board members, they are frequently asked what their counterparts in the industry or other organisations of similar size are doing. The model helps organisations figure out whether they are leading the pack, in the middle, or falling behind, and it’s a good starting point before figuring out what to do next, security-wise.
Bug bounty
For example, knowing that only three organisations in the BSIMM have implemented a bug bounty programme can be useful when trying to prioritise which security activities to work on next. Gary McGraw, CTO of Cigital, noted that 91% of BSIMM firms work with incident response teams and have established clear lines of communication. For organisations that have not defined clear contacts and roles with incident response teams, the finding would be a sign they are not on par with other organisations.
The BSIMM is based on information from 104 enterprises, including 10 health care firms. Participating organisations include Adobe, Aetna, ANDA, The Advisory Board Company, Autodesk, Bank of America, Black Knight Financial Services, BMO Financial Group, Box, Capital One, Citigroup, Cisco, Comerica, Cryptography Research, Depository Trust and Clearing Corporation, Elavon, EMC, Epsilon, Experian, Fannie Mae, Fidelity, F-Secure, HP Fortify, HSBC, Intel Security, JPMorgan Chase, Lenovo, LinkedIn, Marks & Spencer, McKesson, NetApp, NetSuite, Neustar, Nokia, PayPal, Pearson Learning Technologies, Qualcomm, Rackspace, Salesforce, Siemens, Sony Mobile, Symantec, Home Depot, Trainline, TomTom, US Bancorp, Vanguard, Visa, VMware, Wells Fargo, and Zephyr Health. This was also the first time consumer electronics companies that work with the Internet of things were included in the model.
“BSIMM continues to be the authoritative source of observed practices and activities from the most mature software security programmes across industries,” said Jim Routh, the chairman of NH-ISAC.
Fahmida Y Rashid, IDG News Service
Ltd
