The SSECMM

1
The SSE-CMM

• The Past, The Present and the Future

2
Topics for Discussion

• Overview
• Past
• Present
• Future
• Further Information POCs

3
Overview of the SSE-CMM

• What is it?
• System Security Engineering Capability Maturity
  Model
• A model for assessing the security engineering
  aspects of the target organization

4
Overview of the SSE-CMM(continued)

• Why do we need it?
• Confidence that an organization CAN do what it
  claims to do
• Developmental Assurance
• On time and within budget
• A metric for determining the BEST candidate for a
  specified security activity

5
The Past

• 1st Public Workshop
• 1st quarter 1995
• Concept Definition
• Version 1.0 of Model and System Security
  Appraisal Methodology (SSAM)
• Released October 1996

6
The Past (continued)

• The Pilots
• Five conducted with great success
• 2nd Public Workshop
• 14-17 July 1997
• Introduced version 1.1 of Model and SSAM

7
The PastConclusion

• Phase one complete
• Model and SSAM developed
• Model and SSAM released
• Pilots validated use for Internal Assessments

8
The Present

• The Next phase begins
• Identify Sponsor
• Redefine structure to address concerns raised at
  2nd Public Workshop
• Beta assessments to gather metrics on Model and
  SSAM

9
The Future

• The Model and SSAM
• Develop and release refined Model and SSAM to
  address need for third party assessments
• Develop and release training packages
• Pilot assessments to validate third party
  assessment methodology

10
The Future (continued)

• Usage
• As a stand-alone package
• In support of other activities
• Other CMMs
• Evaluation activities
• Procurement
• Life-cycle support

11
Further Information

• Mary Schanken
• Schanken_at_romulus.ncsc.mil
• [phone]
• WWW
• SSE-CMM.org OR aslan.ncsa.uiuc.edu