Tommy Ross — The BSA Framework for Secure Software

Software producers, customers, and policymakers need a common way to discuss security without pretending that one checklist fits every product. Tommy Ross, a policy leader at BSA and a drafter of its Framework for Secure Software, explains how the framework was created and who it is meant to help. He describes its outcome-focused structure, the relationship between functions and more specific categories, and the role of existing industry practices. The conversation uses software supply-chain requirements to show how a high-level goal can become a useful discussion about evidence and risk. Tommy also explores procurement questions, policy needs, and the process for collecting feedback. The result is an introduction to a shared vocabulary for evaluating software security.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Tommy Ross:
→ Tommy Ross at RSA Conference

Mentioned in this episode:
→ BSA Framework for Secure Software — PDF
→ Framework repository
→ SAFECode

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The BSA Framework for Secure Software
01:24 Tommy’s path into security policy
04:17 What BSA does
06:09 Introducing the software security framework
10:27 Producers, buyers, and policymakers as audiences
14:24 A common vocabulary for customer requirements
20:10 How the framework was developed
24:05 Functions, categories, and outcomes
27:21 A software supply-chain example
28:17 Applying a requirement in practice
29:20 Questions policymakers can ask
32:51 Finding the document and contributing feedback