Getting over the 'Adoption Hump'... Evaluating security frameworks and tools ... Help with the code review process

This month's feature article, Getting over the 'Adoption Hump', addresses the inevitable mountain of unknown vulnerabilities that a company faces when implementing SSA. It also shows how, in the long term, this mountain becomes a molehill as organizations begin proactively institutionalizing SSA tools and practices across development teams.

In this month's best advice column -- How to get advice about security frameworks and tools -- readers offer suggestions on where to look for resources and how to evaluate tools.

In this month's dilemma -- Help with the code review process -- one reader is looking for advice on how to start the code review process and whether or not to use automated tools. Your suggestions are welcome!

Also, let us know how successful we are at including articles relevant to you by taking a one-minute reader survey. We'll be giving away three t-shirts. You could win one for answering the survey, for answering this month's dilemma or for submitting a question that could be used as a dilemma.

If you would like to unsubscribe from this newsletter, please click on link at the bottom of the page.

Dealing with security flaws after initially running software security

Amir Hartman and Craig LeGrande, Co-Founders and Managing Directors, Mainstay Partners

After running software security solutions for the first time, companies commonly uncover hundreds to thousands of new vulnerabilities. Dealing with this initial explosion of security flaws can sometimes be daunting. Here's how many companies "get over the hump." 

In our recent study of the economics of software security assurance (SSA) solutions, Mainstay Partners developed a framework for understanding how companies learn to exploit the full potential of SSA. Based on interviews with 20 security executives, the study revealed distinct phases that companies pass through on the way to establishing mature, high-value application security programs. Read more