Writings

• McGraw: Seven myths of software security best practices (October 1, 2015)
• McGraw: Security Risks of Dynamic Code (August 12, 2015)
• McGraw: How to build a team for software security management (March 20, 2015)
• Gary McGraw: When risk management goes bad (February 20, 2015)
• McGraw asks who’s in charge of medical device security (December 1, 2014)
• McGraw on why DAST and RASP aren’t enterprise scale (November 6, 2014)
• McGraw on the IEEE Center for Secure Design (August 26, 2014)
• McGraw on assessing medical devices: Security in a new domain (June 13, 2014)
• McGraw on Heartbleed shock and awe: What are the real lessons? (May 1, 2014)
• Firewalls, fairy dust and forensics? Try software security (March 31, 2014)
• Software [in]security and scaling automated code review (January 28, 2014)
• Software [in]security and scaling architecture risk analysis (December 24, 2013)
• Software [in]security — BSIMM-V does a number on secure software dev (October 29, 2013)
• Software [in]security — software flaws in application architecture (September 10, 2013)
• Five major technology trends affecting software security assurance (August 9, 2013)
• NSA data collection programs demand discussion, scrutiny (June 17, 2013)
• Financial services develop a proactive posture (June 10, 2013)
• BSIMM4 measures and advances secure application development (May 10, 2013)
• Chinese Hackers, ‘Active Defense’ and Other Bad Ideas (Information Security April 2013)
• Cyberwar calls for software and system investment, not hacking back (March 20, 2013)
• McGraw’s mobile app security strategy: Three legs of ‘trusted on busted’ (February 13, 2013)
• Testing, assessment methods offer third-party software security assurance (February 5, 2013)
• Thirteen principles to ensure enterprise system security (January 17, 2013)
• Twelve common software security activities to lift your program (December 10, 2012)
• Proactive defense prudent alternative to cyberwarfare (November 1, 2012)
• Ten commandments for software security (October 4, 2012)
• Data supports need for security awareness training despite naysayers (September 4, 2012)
• Congress should encourage bug fixes, reward secure systems (August 1, 2012)
• Mobile security: It’s all about mobile software security (July 2, 2012)
• Cloud computing pros and cons for security (June 19, 2012)
• Eliminating badware addresses malware problem (May 7, 2012)
• Software security assurance: Build it in, build it right (April 10, 2012)

• vBSIMM Take Two (BSIMM for Vendors Revised) (January 26, 2012)
• BSIMM versus SAFECode and Other Kaiju Cinema (December 26, 2011)
• Third-Party Software and Security (November 30, 2011)
• Software Security Training (October 31, 2011)
• BSIMM3 (September 27, 2011)
• Balancing All the Breaking with some Building (August 30, 2011)
• Software Security Zombies (July 21, 2011)
• Partly Cloudy with a Chance of Security (June 17, 2011)
• Computer Security and International Norms (May 30, 2011)
• vBSIMM (BSIMM for Vendors) (April 12, 2011)
• Modern Malware (March 22, 2011)
• Software Patents and Fault Injection (February 28, 2011)
• Comparing Apples, Oranges, and Aardvarks (or, All Static Analysis Tools Are Not Created Equal) (January 31, 2011)
• Driving Efficiency and Effectiveness in Software Security (December 29, 2010)
• Cyber Warmongering and Influence Peddling (November 24, 2010)
• Technology Transfer (October 26, 2010)
• How to p0wn a Control System with Stuxnet (September 23, 2010)
• Software Security Crosses the Threshold (August 16, 2010)
• Obama Highlights Cyber Security Progress (July 16, 2010)
• Cyber War – Hype or Consequences? (June 17, 2010)
• BSIMM2: Measuring the Emergence of a Software Security Community (May 12, 2010)
• Assume Nothing: Is Microsoft Forgetting a Crucial Security Lesson? (April 30, 2010)
• The Smart (Electric) Grid and Dumb Cybersecurity (March 26, 2010)
• What Works in Software Security (February 26, 2010)
• Cargo Cult Computer Security (January 28, 2010)
• You Really Need a Software Security Group (December 21, 2009)
• BSIMM Europe (November 10, 2009)
• Startup Lessons (October 22, 2009)
• BSIMM Begin (September 24, 2009)
• Attack Categories and History Prediction (August 25, 2009)
• Moving U.S. Cybersecurity Beyond Cyberplatitudes (July 16, 2009)
• Measuring Software Security (June 18, 2009)
• Twitter Security (May 15, 2009)
• Software Security Comes of Age (April 16, 2009)
• The Building Security In Maturity Model (BSIMM) (March 16, 2009)
• Nine Things Everybody Does: Software Security Activities from the BSIMM (February 9, 2009)
• Top 11 Reasons Why Top 10 (or Top 25) Lists Don’t Work (January 13, 2009)
• Software Security Top 10 Surprises (December 15, 2008)
• Web Applications and Software Security (November 14, 2008)
• A Software Security Framework: Working Towards a Realistic Maturity Model (October 15, 2008)
• Getting Past the Bug Parade (September 17, 2008)
• Software Security Demand Rising (August 11, 2008)
• Application Assessment as a Factory (July 17, 2008)
• DMCA Rent-a-cops Accept Fake IDs (June 12, 2008)
• Securing Web 3.0 (May 15, 2008)
• Paying for Secure Software (April 7, 2008)

• The Truth Behind Code Analysis (February 13, 2008)
• Software Security Strategies (January 9, 2008)
• Beyond the PCI Band-Aid (December 10, 2007)
• Online Games & the Law (October 11, 2007)
• Mobile Insecurity (September 14, 2007)
• The Ultimate Insider (August 14, 2007)
• Consolidate This (July 12, 2007)
• JSON, Ajax & Web 2.0 (June 7, 2007)
• Certifiable (May 9, 2007)
• Want Turns to Need (April 20, 2007)
• Security’s Symbiosis (February 27, 2007)
• Hurray for Hollywood!? (January 12, 2007)
• Foxy Vista Henhouse (December 11, 2006)
• Boarding-Pass Brouhaha (November 2, 2006)
• Diebold Disses Democracy (October 9, 2006)
• Keep Your Laws Off My Security (September 7, 2006)
• Google is Evil (August 4, 2006)
• If You Build It, They’ll Crash It (July 7, 2006)
• New Terrorist Profile: Phone Users (June 13, 2006)
• Microsoft’s Missed Opportunity (May 3, 2006)

• How Flawed Is Microsoft? (March 2006)
• Is Application Security Training Worth the Money? (February 2006)
• Is Sony BMG Run By Malicious Hackers? (January 2006)
• When Does Security Cross the Line? (December 2005)
• Is Security Really About Getting Nothing Done? (November 2005)
• How Bad Is Intrusion Detection? (October 2005)
• Is Cisco Naked? (September 2005)
• Is VoIP Secure Enough For Prime Time? (August 2005)
• Is Penetration Testing a Good Idea? (July 2005)
• Are Cell Phones the Next Target? (June 2005)
• How Does Security Fit With Engineering? (May 2005)
• Is Your Mac Really More Secure? (April 2005)
• Where Does Trust Come From? (March 2005)
• Are We In a Computer Security Renaissance? (February 2005)
• Innovative Rootkits: The Ultimate Weapon? (January 2005)
• How Do Real Bad Guys Break Software? (December 2004)
• Application Security Testing Tools: Worth the Money? (November 2004)
• Who Should Do Security? (October 2004)

A collection/archive of peer reviewed articles written while at Cigital Labs (1996-2011).