SSECMM: Does it provide appropriate system assurance

1
SSE-CMM Does it provide appropriate system
assurance?

• Rick Hefner, TRW (Moderator)
• John Adams, National Security Agency
• Aaron Cohen, Communications Security
  Establishment
• Milan Kuchta, Communications Security
  Establishment
• Marv Schaefer, Arca Systems, Inc.

1995 ACSAC Panel
2
SSE-CMM Background

• Project Goals
• Develop a maturity model and appraisal methods
  for
• Security engineering process improvement
• Security engineering capability evaluation
• Process-based assurance
• Encourage and maintain consistency with other
  CMMs
• Promote commonality and economy of scale
• Project Participants
• Collaborative effort by industry and government
  agencies on their own funding
• Original work sponsored by NSA additional
  funding provided by OSD

3
SSE-CMM Background (continued)

• The model structure permits appraisal of an
  organizations security engineering practices
• Based on maturity model concepts used in the
  software engineering and systems engineering
  community
• Looks for good security engineering practices in
  use and corporate support for these practices
• The model scope addresses
• Providers of secure systems, products, services
• Development, operation, maintenance
  decommissioning
• Information available at
• http//www.ssecmm.ashton.csc.com/