CII Best Practices Badge, 1 Year Later
summary
One-year audit of the CII Best Practices badge reports 66 criteria grouped into six areas, automation that checks claims, and 500+ projects pursuing a badge with 60+ badges issued. Most-missed items are concrete: top challenge: tests added and missing published vulnerability reporting and HTTPS on project sites. Badge-driven changes include adding automated tests, TLS, static analysis, and published vuln processes; draft passing+1 criteria: reproducible build and governance/bus-factor rules for higher tiers.
AI-written summary · about
chapters (21)
- 0:00Institute for Defense Analyses
- 0:14IDA Background
- 1:42IDA CII Best Practices Badge
- 4:33IDA Criteria
- 5:24IDA Badge scoring system
- 6:30IDA Initial announcement
- 8:14IDA CIl badges are getting adopted!
- 8:57IDA Some additional badge holders
- 9:54IDA Sample impacts of Cil badge process
- 11:19IDA Biggest challenges today for getting a badge
- 13:14IDA Tests
- 15:10IDA Vulnerability reporting
- 16:30IDA HTTPS
- 17:42IDA Analysis
- 18:58IDA Know secure development
- 20:35IDA Documentation
- 21:31IDA Good news
- 22:44IDA Higher-level criteria
- 24:13IDA Some proposed passing+1 criteria
- 28:07IDA Involved in OSS?
- 30:13IDA In conclusion: Key URLS
related talks
39mImplementing the OpenSSF Best Practices Badges & Scorecards Into Your Project
53mImplementing the OpenSSF Best Practices Badges & Scorecards Into Your Project
33mOWASP Top 10 Maturity Categories for Security Champions
53mOver a Decade of Software Security: What Have We Learned
40m5 Pillars of Security Success
41mSecurity Champion Worst Practices
47mOWASP Top 10
54mBenchmarking the Security of Your Software Supply Chain