BSIMM update (informIT)

[coley at linus.mitre.org (Steven M. Christey)]

On Tue, 2 Feb 2010, Arian J. Evans wrote:

> BSIMM is probably useful for government agencies, or some large
> organizations. But the vast majority of clients I work with don't have
> the time or need or ability to take advantage of BSIMM. Nor should
> they. They don't need a software security group.

I'm looking forward to what BSIMM Basic discovers when talking to small 
and mid-size developers.  Many of the questions in the survey PDF assume 
that the respondent has at least thought of addressing software security, 
but not all questions assume the presence of an SSG, and there are even 
questions about the use of general top-n lists vs. customized top-n lists 
that may be informative.

- Steve