See these past (mysteriously named) articles for data from previous years:

• InformIT (2008): Software Security Comes of Age: Space Approaches $500M threshold
• InformIT (2007): Software Security Demand Rising
• Darkreading (2006): Want Turns to Need

The Figure above shows in millions of US dollars how the four major segments of the space have grown since 2006, from a total of $293.9 million (2006) to a total of $554.4 million in 2009. Note that even stronger growth is evident midway through 2010.

Analysis and details are available in the informIT article.

Here is a picture I took of President Obama addressing the meeting. Howard Schmidt is to the far left. Beside him is Department of Homeland Security (DHS) Deputy Undersecretary Phil Reitinger. The moment President Obama entered the meeting was electric. Attendees immediately stood and gave him an ovation. The room was energized, and the President’s charisma was palpable. I, for one, was proud to be there.

In addition to remarks from President Obama and Howard Schmidt, the meeting was addressed by two cabinet Secretaries—Janet Napolitano, Secretary of DHS, and Gary Locke, Secretary of Commerce. The invitation-only event included members of the Administration, state and local government officials, law enforcement officers, select industry executives, academics and representatives from privacy and civil liberties groups. Attendees who I know included Matt Blaze, Carl Landwehr, Ed Amoroso, Marc Rotenberg, Eugene Spafford, Mischel Kwon, and John Savage.

I wrote up my thoughts on the meeting in an informIT article “Obama Highlights Cyber Security Progress: Private Sector Security Experts Convene at the White House to Discuss the National Cyber Securiy Agenda.”

Howard described his impressions of the meeting and its purpose on the White House blog. An official progress report is also available there.

For our 50th episode, we decided to shoot some HD video or our interview with Richard Clarke. Ryan and I bought some cheap digital cameras, (really importantly) some lights, and a “clapper” which we drove out to Arlington for the shoot. We recorded audio separately with boom mics and a USB mixer. Then came the video editing…

And the result? Check it out yourself here:

It amazes me what you can do for less than $1000 bucks with video these days. Shouts to Marcus Ranum for the photography advice. Thanks Ryan for the extra effort on this episode! And also thanks to IEEE Security & Privacy magazine for co-sponsoring the podcast.

We hope you like Silver Bullet, and we welcome your feedback on the Silver Bullet website. Subscribe today via RSS or on iTunes.

BSIMM2 is available for free under the creative commons license from bsimm2.com. Download your copy today.

The BSIMM2 document itself is 53 pages. A concise treatment of the results can be found in this month’s informIT column in an article titled “BSIMM2: Measuring the Emergence of a Software Security Community.”

Our study represents the work of 635 people who are members of the 30 firms’ SSGs. Together, the firms have a collective 130 years of experience planning and executing 30 software security initiatives. Among other results, we have identified 15 core BSIMM activities.

We think the descriptive nature of the BSIMM study is an important characteristic of the work. We describe not what you should do for software security, but what successful software security initiatives are actually doing. Use BSIMM2 to measure your own software security initiative and compare it to others.

In his new book Cyber War, co-authored by foreign policy expert Robert Knake, Mr. Clarke confronts an important topic too often swept under the rug with the burgeoning pile of security FUD—the notion of cyber war. US citizens have every right to worry about cyber war given our risk exposure. The risks of cyber war and some of the potential consequences are impressively covered in the book and even include doomsday scenarios that are getting Dick into hot water with the hipsters at Wired. Consider how little North Korea depends on the Internet (ok, they are only barely scraping by as a society), then consider the same dependency in the US. See the problem?

One of the challenges of discussing computer security rationally in the Internet Age is that devastating consequences always seem hyperbolic, even when they’re not. Turns out that taking down the power grid with a cyber attack is not outside the realm of possibility. I’ve been told by people who actually engineer and run the grid for a living that inflicting permanent damage taking years to fix is more than possible given current design. Nor is the notion of an Information Warfare attack preceding “kinetic” involvement with explosive chunks of metal some kind of idea from Mars. One of the coolest stories in the book involves the Israeli destruction of the ill-fated Syrian nuclear facility. Scary? Yes. Hyperbolic? Not so much.

There are a few technical nits to pick, of course. Calling out the Estonian dDOS attack (most likely perpetrated by the Russians) as some kind of major cyber attack is a bit over the top. dDOS attacks are the stuff of script kiddies and solutions that thwart them are over a decade old. Most problematic of all is the overemphasis on network security mechanisms and ISPs as proposed technical solutions to the problem. I know Ed Amoroso (CSO of AT&T) believes that security defenses and monitors need to be put in place in the tier1 ISPs, and it’s very clear that he has convinced Dick of that. But as a computer security expert, I am skeptical of that solution. In my view, the only way we can properly address the cyber war problem is by attacking software security head on. Fortunately Dick says the right things about software vulnerability, demonstrating a nuanced understanding all too rare among politicals.

From a policy perspective, the ideas in Cyber War are fresh, new, and important. Dick’s mastery of arms control strategy comes to the fore when he discusses various ideas about cyber war non-proliferation. I must confess that my knowledge of such things is rudimentary at best. I wonder, probably naïvely, how we can think of controlling something as invisible as cyber attack capability (not to mention Trojan Horses and logic bombs) when we can’t even stop Iran from refining uranium like the complete nut-jobs that they are. But SALT II and START came from somewhere, and they have been a very good thing for the world.

Some of my foreign colleagues in computer security (but not all, see this posting from Italy for example) wonder why we are so obsessed with cyber war in the States. They are not sure why we are the only society openly discussing these things. Perhaps they hear the drums of war beating again as they did in the impressively-orchestrated and utterly-delusional run up to the Iraq war. More likely I think the answer to that question lies in understanding just how vulnerable we are in the States. We may not be the most wired country in the world from a consumer perspective, but we’re the most wired country in the world from a critical infrastructure perspective. Cyber war is a serious problem that calls out for serious solutions.

In final analysis, I think it behooves every computer security person to read this book and think through its points carefully. Even if you disagree with some parts of the book (as I do), we must do what we can as technically adept citizens to involve ourselves in the political discourse around cyber war. Dick does an excellent job getting the conversation started.

Of course I ended up touching on software security, especially the fact that power meters for the “smart grid” are little IP-enabled computers hung on the outside of your house. Given known attacks against this new breed of meters, the question is how many rooted smart grid meters in a botnet could cause a really serious problem?

Here is my talk in its entirety. Your feedback is welcome.

Download audio [mp3]
Download presentation [pdf]

I’m pleased that Cigital is directly involved in working to make smart grid security a reality. We’re working directly with NRECA to bring electric cooperatives up to speed with cyber risk management.

We’re unveiling some statistical results at RSA this week that will enhance and expand the dataset published in the article. We’ll do an official BSIMM2 launch within the next couple of months.

So why am I not a big fan of these lists? Well, I wrote that down a year ago and what I said then still applies. Sure would be nice to see a reasoned response to my criticisms instead of repetition of the same tired ideas. If you haven’t had a chance yet, go read my January 2009 informIT column “Top 11 Reasons Why Top 10 (or Top 25) Lists Don’t Work.”

There are some important improvements in this year’s top25 list that have been discussed on sc-l. But there is also a problem that really bothers me. The SANS guys are trying to tie the top25 list to software liability (?!) and apparently think they can hold developers accountable for their bugs..well, 25 of them at least. I think this is a wrongheaded approach to software security. I would much rather talk about the real progress the field has made than to hype up yet another list and make the list a critical aspect of software contracts?! Can you imagine what such a move (if it succeeded) would do to the price of software and to the hourly rates of developers? Developers would be compensated like lawyers!

Top-n lists do have their place. In the BSIMM we note 10 firms (of 30) who follow activity [CR1.1]. Here is the activity cut from the BSIMM:

Create a top N bugs list (real data preferred). The SSG maintains a list of the most important kinds of bugs that need to be eliminated from the organization’s code. The list helps focus the organization’s attention on the bugs that matter most. A generic list could be culled from public sources, but a list is much more valuable if it is specific to the organization and built from real data gathered from code review, testing, and actual incidents. The SSG can periodically update the list and publish a “most wanted” report. (For another way to use the list, see [T2.2] Create/ use material specific to company history.)

In my view, a tailored top-n bugs list is way more useful than a generic “world list” like the SANS/CWE25. To think about why this is, consider the differences between code bases from Intel, Microsoft, Symantec, and Nokia (not to mention Wells Fargo)…all BSIMM participants. Whose bugs do you want to eradicate? Yours? Or your neighbors?

Press coverage of the “controversy”:

• SANS Institute, MITRE release new top 25 dangerous coding errors list, TechTarget.
• Top 25 Programming Errors: Should Software Developers be Liable?, Bank Info Security.
• Hold vendors liable for buggy software, group says, ComputerWorld.
• 25 ways to better secure software from cyber attacks, Scientific American Observations.
• Security agencies release Top 25 programming errors, Washington Technology.
• Proposal Would Hold Software Developers Accountable For Security Bugs, Dark Reading.
• Group Proposes Suits Over Faulty Code, Gov Info Security.

One question that comes up in the BSIMM work fairly consistency is the difference between BSIMM and other maturity models for software security. To answer that question, I wrote an article for informIT entitled “Cargo Cult Computer Security: Why we need more description and less prescription.”

Download audio [mp3]

David Rice, the author of Geekonomics (as well as the 46th Silver Bullet Security podcast victim), and I discuss the BSIMM in a webcast about the upcoming SANS software security event in San Francisco.

The time for science is upon us. And the first step in any scientific approach is measurement.

Here’s what the White House has to say.

Back in July I talked about what I would like to see in the position in a Justice League post and a video for Gartner. I stand by my statements from July. However, I am psyched that Howard is taking the job. He understands the importance of building security in and will be a powerful advocate for software security.

What a great way to start 2010!