Pass your certification exam. Faster. Guaranteed.

Maturity Models Transcription

Welcome to our maturity models module. Maturity models are metrics for your software developers to determine if they're following a structured approach or not. The Capability Maturity Models, or CMM, provide a reference model of mature practices for software development companies and show their ability to develop applications in a predictable and reliable manner.

CMMs have emphasized process maturity to meet three critical business goals. The first is better schedule management, the second is better quality management and maintenance, and the third is a reduction in the general rate of defects that occur in software that they're developing. The Capability Maturity Models don't define the process, they define the characteristics of the process.

They define what should be tracked and what should be improved, but not necessarily how to accomplish those goals. The Capability Maturity Model Integration, or CMMI, is a collection of good practices and characteristics for programmer assurance. It provides guidance for improving your organization's processes and helps to better manage the development, acquisition, and maintenance of products and services.

It replaced CMM in 2007 and it organizes the practices into structures that can help your organization assess your current processes, establish priorities for improving your processes, and document and implement your improvements. It will help you to learn what works and to make further changes to improve your performance on a continuing basis.

Basically, it helps you to improve your processes so that you can produce better products. The Systems Security Engineering Capability Maturity Model, or SSECMM, is the only CMM that was specifically developed to address security in addition to maturity, and you should remember this model for the CISSP examination. Remembering specifically that it addresses security.

The SSECMM defines five different levels of performance with level one being the lowest and level five being the highest. Level one is very informal and is not considered to be a successful level. At level two, you are attempting to understand what is happening with your project before you define your processes, so we're moving up the scale and performing better.

Level three is well defined where you used what you've learned from the project to create processes that you will use in your entire organization. At level four, you are quantitatively controlling the process with measurable statistics but you must know what it is that you're trying to measure first.

Level five is the best level of the SSECMM where you focus on continuous improvement and this level demonstrates that you have a foundation of sound management and awareness in your organization. The SAMM model, or Software Assurance Maturity Model, is an open source model that was released in 2009. It's designed to help your organizations formulate and implement strategies for software security. It is maintained through the OpenSAMM Project, which is part of the OWASP, or the Open Web Application Security Project. This model can be tailored to specific risk environments depending on the organization. Maturity level zero is always a starting point and here your desired activities are not yet fulfilled.

Maturity level one is considered a beginner level where practice areas, activities, and processes are understood to a minor extent but the fulfillment of these activities is unstructured. Maturity level two is where your practicing efficiency and your effectiveness is increasing, and maturity level three shows a mastery of the areas where all of your activities and processes are comprehensive and basically you have a full scale mastery of the areas.

For the CISSP examination, you should remember that the Software Assurance Maturity Model, or SAMM, is the only open source model and that the first level of this model is maturity level zero, not one like you might expect. This concludes our maturity models module. Thank you for watching.