Secure Software Unveils CLASP, a Comprehensive Process to Dramatically Improve Software Security.

LA JOLLA, Calif. -- CLASP Integrates Security into the Application Development Process

Secure Software, an authority in automated application security products and process technology, today announced the immediate, free availability of CLASP (Comprehensive, Lightweight Application Security Process), a process guide that helps organizations incorporate security into their application development lifecycle. CLASP reflects years of work with development teams to address security issues. It is authored by John Viega and Secure Software, with assistance from IBM and webMethods. CLASP is shipping with all Secure Software products and a complimentary download is available at www.securesoftware.com.

"Today's development organizations are faced with the traditional time-to-market and cost pressures that make them hesitant to introduce new processes into the software development lifecycle," said Melissa Webster, research director at IDC. "However, they are facing increasing market and management pressure to produce more secure applications. By integrating security best practices into their existing development processes, organizations can dramatically improve the security of their software while reducing the cost and time-to-market impact associated with existing approaches such as manual code audits and post-development remediation."

CLASP, derived from accepted best practices for building secure software, is an activity-driven and role-based process that offers practical hands-on guidance to everyone in the software development lifecycle. Designed to integrate with an organization's existing development processes, CLASP activities document what needs to be accomplished, by whom, and when, to ensure increased security and integrity.

"Meaningful improvements in application security can be achieved via better security practices in the development lifecycle. This is only likely to happen when the security teams understand and support the process-oriented needs of development shops," said Amit Yoran, private security advisor and former Bush Administration Cyber Chief. "The application security process provides clear guidelines development organizations can follow to weave proven security processes into their practices without significant cost impact or lengthening of the existing development schedule."

"The proliferation of off-shore application development, combined with the compliance pressures of Sarbanes-Oxley, GLBA and other regulatory requirements, has raised the security stakes significantly for those affected large organizations," said Vincent Campitelli, managing director of Emerging Risk for the Internal Audit Division of Wachovia Bank. "Integrating rigorous security process into the application development lifecycle can be significantly less expensive than retrofitting applications and has a greater overall impact on reducing organizational risk."

CLASP is designed to be both easy to adopt and quickly integrated into existing software development processes. It takes a prescriptive approach, documenting critical activities that each member of the software project team must consider. CLASP provides an extensive wealth of security resources (templates, guidelines and white papers) making implementation of key activities predictable and reasonable, particularly when also introducing tools to help automate various security functions within the overall software development lifecycle (SDLC).

"Software development is a professional discipline and, in many respects, the process is more important than the software tools employed. This fact has escaped the attention of many IT security vendors," said Robin Bloor, partner at Hurwitz Associates and a former developer. "Many vendors place far too much emphasis on automating the discovery and remediation of vulnerabilities during later stages of the product lifecycle. The most economic and efficient approach is to remedy such problems as early in the project as possible. Secure Software's CLASP is the first approach I have seen that focuses on this and builds the security process into the design and development phases. It is a 'best practice' approach to improving the security of software."

CLASP includes:

1) Descriptions of approximately two dozen specific activities that can be implemented within a software development (or deployment) lifecycle to increase security. For each activity, CLASP outlines a number of specific steps that may be taken, and documents such factors as the purpose of the activity, who owns the task and the relevant contributors to it, the applicability or scope of the task, its potential impact, frequency, and cost (in time).

2) Eight roles within the SDLC (project manager, security auditor, etc.) and the activities for which they are responsible for completing and that they participate in completing. By examining related activities, individuals are able to readily identify specific actions they can take within the scope of their responsibility to improve security.

3) Best Practices

At the core of CLASP are seven best practices:

--Institute security awareness programs

--Publish software security policies & operational guidelines

--Establish software security development practices

--Monitor security metrics 

--Manage vulnerability remediation processes

--Establish security assessment strategy

--Establish software management control processes

Each of these best practices are intended to address root cause software security issues which if left unattended can result in highly exploitable conditions in business critical applications. The consequences of non-action can be loss of data, identity theft, attack by worms, viruses, trojans, and denial of service--all having a significant economic impact on today's businesses.

4) An Implementation Guide, documenting--for different types of projects--how an organization can approach the task of implementing CLASP, including the specification of a process engineering plan and a supporting team.

5) A vulnerability root cause reference, providing specific information on different types of vulnerabilities--including the cause of the vulnerability, potential consequences, where in the lifecycle it can be introduced, how it can be avoided or remediated, and examples and discussions.

"Secure Software is doing for software security what Rational did for application development," said Kevin Kernan, CEO of Secure Software and seventeen-year veteran of Rational Software and IBM. "Driving industry collaboration and providing industrial-strength capability was a critical part of Rational's success. The application security sector requires a similar approach."

About Secure Software

Secure Software provides application-security products and process technology that help organizations cost-effectively eliminate security flaws at the source - insecure software code - in legacy, acquired and new-start applications. The Company's recently launched CodeAssure(TM) product suite automates the discovery and vulnerability analysis for prioritizing and fixing insecure software code, and provides process guidance for building more secure applications early in the development lifecycle. Based in McLean, Va., Secure Software sells its solutions to large government agencies and utilities, financial institutions, healthcare organizations and independent software vendors. For more information visit www.securesoftware.com.