On Tuesday February 23rd at 6 PM, Gary McGraw will be holding a public
lecture on the Building Security In Maturity Model (BSIMM -
http://bsi-mm.com). The lecture is organized jointly by secappdev.org
and the Leuven Center on Information and Communication Technology
(LICT), a K.U. Leuven multi-disciplinary research center.

The lecture will describe the observation-based BSIMM maturity model,
drawing examples from many real software security programs in leading
companies. A maturity model is appropriate because improving software
security almost always means changing the way an organization works.
While not all organizations need to achieve the same security goals, all
successful large scale software security initiatives share common ideas
and approaches. BSIMM can be used as a yardstick to determine where one
stands and what kind of software security strategy will work best in a
specific case.

The lecture will be held in ESAT's auditorium A in Heverlee and is free
of charge. However, registration is required by February 15th at
http://www.esat.kuleuven.be/LICT/ - follow the link for upcoming new
activities in the right margin. Sandwiches will be provided before the
lecture. The lecture, including a Q&A session, will take approximately
90 minutes, but those who feel like continuing the discussion, are
welcome to join the SecAppDev 2010 pub crawl afterwards.

Gary McGraw will go into more depth about his BSIMM work at SecAppDev
2010. In particular, he will highlight the results from the European
study and how they compare to the North-American sample. He will also
speak in more depth about the practices found to be most successful by
the participants in the study.

Unfortunately, Richard Clayton had to drop out of this year's faculty.
We believe his colleague Steven Murdoch will prove to be a worthy
replacement. Steven has been grabbing headlines these last few days for
his work on Visa's 3DS. I am sure that his lecture on banking security
architectures will prove to be one of the highlights of this year's
course.

In the meantime, the program for SecAppDev 2010 is being finalized
(http://secappdev.org/pages/8). Check out the other exciting speakers
who will be ensuring that SecAppDev remains at the vanguard of secure
software engineering. There are still some places left at SecAppDev
2010, but do not delay registration. I am looking forward to your
comments and hope to see you soon.

Johan Peeters Program Director http://secappdev.org