Talk:Software security assurance

Copy edit

I have reviewed this article. The grammar was good; there were some capitalization errors, especially in section titles, and some cases in which a paragraph/sentence-based list was more appropriate than a bulleted or numbered list.

The content looks a bit brief for this topic; wikification will aid in readers' understanding, but some phases of this process are introduced without any discussion of their ramifications or important considerations. -Paulmnguyen (talk) 23:52, 26 August 2010 (UTC)

I did some wikification and rewrote the lead section to be more forward, rather than like the slow introduction of a textbook. I still think that the article deserves more "meat on its bones." -Paulmnguyen (talk) 00:23, 27 August 2010 (UTC)

Merge to Software assurance

Noting @Joereddington's proposed deletion reason: "Article is largely an unsourced how-to/essay-style treatment of software security assurance rather than an encyclopaedic article. It has carried citation and instructional-content maintenance tags for many years, relies mainly on one dated 2007 report plus weak/non-specific references, and substantially overlaps with broader topics such as secure by design, secure coding, software quality, and security engineering. No clear independent notability is established for this as a standalone topic."

Based on WP:ATD-M: "If two pages are duplicates or otherwise redundant, one should be merged and redirected to the other, using the most common, or more general page name." I recommend merging this to software assurance, since people use that term in a way that includes security assurance:

• NIST definition of "software assurance": "The level of confidence that software functions as intended and is free of vulnerabilities, either intentionally or unintentionally designed or inserted as part of the software throughout the lifecycle."

• "This article...proposes a new Security Assurance Model (SAM) for Software Development...The SAM of Software Development consists of seven security assurance levels: Governance and Security Threat Analysis, Secure Requirement Analysis, Secure Design, Secure Coding, Secure Testing and Review, Secure Deployment, and Security Improvement."

• "This study advances the core concepts of software security through the application of security assurance techniques, including vulnerability scanning, code review, penetration testing, threat assessment, control evaluation, mitigation, risk assessment, and configuration review. In the context of the Software Security Reliability Model (SSRM), a framework was developed to enhance software security assurance across different stages."

• "The acquisition and operation of a system with effective software assurance requires effective software risk management throughout the lifecycle to identify and mitigate potential mission impacts...our team of researchers in cybersecurity, acquisition, and system and software engineering have identified five foundational capabilities (pillars) that must be well established to support the acquisition of a system with effective software assurance: Software Requirements, Software Supply Chain Risk Management, Software Quality, System Integration, and Software Metrics."

• "Software assurance encompasses the development and implementation of methods and processes for ensuring that software functions as intended while mitigating the risks of vulnerabilities, malicious code or defects that could bring harm to the end user."
• The NIST SAMATE (Software Assurance Metrics And Tool Evaluation) project...Development of metrics for the effectiveness of software security assessment (SSA) tools...The first part classifies Software Security Assurance tools and develops metrics and tests for each tool class."

References

Dreamyshade (talk) 20:06, 19 June 2026 (UTC)