Deriving Software Security Measures from Information Security Standards of Practice
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
This white paper describes an approach for deriving measures of software security from well-established and commonly used standard practices for information security. This work was performed as part of the Software Engineering Institute's Software Security Measurement and Analysis (SSMA) project. It is an initial demonstration of how SSMA-defined software security drivers can be used in concert with practices and standards to derive meaningful measures of software security.
Cite This SEI Report
Alberts, C., Allen, J., & Stoddard, R. (2012, February 16). Deriving Software Security Measures from Information Security Standards of Practice. Retrieved October 24, 2026, from https://www.sei.cmu.edu/library/deriving-software-security-measures-from-information-security-standards-of-practice/.
@techreport{alberts_2012,
author={Alberts, Christopher and Allen, Julia and Stoddard, Robert},
title={Deriving Software Security Measures from Information Security Standards of Practice},
month={Feb},
year={2012},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/deriving-software-security-measures-from-information-security-standards-of-practice/},
note={Accessed: 2026-Oct-24}
}
Alberts, Christopher, Julia Allen, and Robert Stoddard. "Deriving Software Security Measures from Information Security Standards of Practice." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, February 16, 2012. https://www.sei.cmu.edu/library/deriving-software-security-measures-from-information-security-standards-of-practice/.
C. Alberts, J. Allen, and R. Stoddard, "Deriving Software Security Measures from Information Security Standards of Practice," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 16-Feb-2012 [Online]. Available: https://www.sei.cmu.edu/library/deriving-software-security-measures-from-information-security-standards-of-practice/. [Accessed: 24-Oct-2026].
Alberts, Christopher, Julia Allen, and Robert Stoddard. "Deriving Software Security Measures from Information Security Standards of Practice." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 16 Feb. 2012. https://www.sei.cmu.edu/library/deriving-software-security-measures-from-information-security-standards-of-practice/. Accessed 24 Oct. 2026.
Alberts, Christopher; Allen, Julia; & Stoddard, Robert. Deriving Software Security Measures from Information Security Standards of Practice. Software Engineering Institute. 2012. https://www.sei.cmu.edu/library/deriving-software-security-measures-from-information-security-standards-of-practice/