Question

A CISO wants to objectively benchmark the organization's software security program across activities such as governance, secure design, secure build, and security testing, and to produce a roadmap that shows measurable improvement over successive years. Which approach BEST meets this goal?

Accepted Answer

Adopt a software security maturity model such as OWASP SAMM or BSIMM to assess current practices and define target maturity levels

Answer

Run an authenticated vulnerability scan against production applications each quarter and track the number of findings

Answer

Require every development team to achieve 100% code coverage in unit tests before release

Answer

Purchase a commercial web application firewall and enable all protection rules in blocking mode