“We already have frameworks”

Reality: If frameworks alone were going to make software safe, they would have done so by now.

Numerous frameworks guide safer software development — yet products continue to exhibit the very classes of defects they were meant to prevent.

A bigger concern is how little these frameworks focus on measuring customer costs and harm. When they mention "risk-based decisions," the risk being measured is usually to the manufacturer, not the user.

Discussion prompts

• Which secure development framework does your team follow, and how do you measure the outcomes over time?
• How does your framework account for harm to customers?
• When you make "risk-informed decisions", whose risk are you measuring: yours, or the customers'?