Wednesday, March 10, 2010

About the 'Rugged' Initiative

As most of the readers on my blog would be knowing, the Security experts in February launched a new effort to ensure software is written from the ground up with security in mind -- a philosophy and message they're aiming at people outside of the security industry.

The Rugged Software Development initiative is basically a foundation for creating resilient software that can stand up to attackers while performing its business or other functions.

"It's more of "a value system" for writing secure software, versus a compliance program, according to its founders,who hope to incorporate the tenets of rugged code development into computer science programs at universities."

A couple of years back, I remember posting a blog article, if basic security mantras could be incorporated in the Computer Science & IT Courses in Universities. Here is the link to the same: . I was happy that to learn that 'Rugged' did have this as a part of its initiative. Question is, "When will Indian Universities understand and incorporate the same?" The Indian IT industry spends so much on training costs, as more than 70% of fresh graduates are not employable/productive right away.

This isn't the first industry effort to push developers to bake security into their code. There have been several before like: Homeland Security's Build Security In guidelines, Microsoft's Software Development Lifecycle (SDLC) framework and tools, Building Security In Maturity Model (BSIMM), where financial services firms are comparing notes and sharing their secure coding strategies and experiences and OpenSAMM (Software Assurance Maturity Model), an open-source model aimed at becoming an industry standard for secure software development.

Rugged doesn't include any new frameworks for secure coding, however, and instead will serve as an "on-ramp" for secure software development, Rugged is different because it's aimed at people outside of the security realm. Rugged is specifically targeted at people out of the security context.

Getting the secure software development message to the masses won't be easy, and the plan is to get some initial support and momentum from the application security industry.

Unfortunately, most developers don't know what it means to write secure code, and worse they think they already write secure code if they write high quality code. Software security practitioners have struggled to get past this mindset.

Rugged code is a way of breaking through and instilling a mindset that secure code should be a pride-of-ownership issue just as much as elegant, high performing, and high quality code is.


  1. Your article implies that BSIMM is not "open source." The BSIMM is available to everyone at Also it does not include only financial institutions. The BSIMM guys did a presentation at RSA last week and said there is now data from 30 companies in their study and the companies are from at least a half-dozen verticals. The BSIMM is built from these data, which makes it unique.

  2. Dear Anonymous Friend,

    The post no where tries to say that BSIMM is not "open source".

    The point was that 'Rugged' isn't the first one to push initative towards Security. There have been many before like BSIMM, OpenSAMM, MS SDLC, etc.

    Hope that addresses your concern.

  3. Your blog keeps getting better and better! Your older articles are not as good as newer ones you have a lot more creativity and originality now. Keep it up!
    And according to this article, I totally agree with your opinion, but only this time! :)

  4. It is useful to try everything in practice anyway and I like that here it's always possible to find something new. :)

  5. Amiable brief and this post helped me alot in my college assignement. Thank you on your information.

  6. Sorry for my bad english. Thank you so much for your good post. Your post helped me in my college assignment, If you can provide me more details please email me.