Areas of Expertise
Software Security | Governance and Risk Management | DevSecOps | Software Supply Chain Security | Threat Modeling | Security Metrics and Dashboards
About Sammy
Sammy Migues is a recognized cybersecurity technical leader and lifelong innovator. At The Chertoff Group, he contributes to Cybersecurity solutions for customers spanning software security, governance and risk management models, compliance, metrics and dashboards, threat modeling, DevSecOps, software supply chain security and digital transformation. Sammy’s leadership has created value for defense contractors and high-profile customers in every major market sector.
Recent Engagements
- For a global IT security software vendor, advised on software development lifecycle security governance best practices and helped to strengthen the product risk management function.
- For a global cybersecurity software provider, supported a Secure Software Development Framework (SSDF) maturity assessment and created a remediation roadmap to address gaps.
- Worked with a large law firm to modernize software development practices, remove development process technical debt, and accelerate security integration.
- Long-term engagement with a global software provider to create a new product security program, a high-assurance software development pipeline, and the associated governance and processes. Additional work with a business unit focused on FedRAMP and DoD IL5.
Career Highlights
- Creator of the Building Security In Maturity Model (BSIMM), a set of controls and an assessment methodology for software security program scorecards; through the BSIMM’s interview-based approach, spoke with over 1,000 CISOs, managers and engineers and created data-driven annual research publications
- Creator of the BSIMMsc, a streamlined method for analyzing and scoring software suppliers’ secure development practices; The CISO Study, an analysis of and scoring approach for CISO security management practices; and P-SSCRM, a comprehensive model for reviewing organizational software supply chain risk management efforts
- Contributed to practical security models and approaches to computer and network security seminal works and groups including the Rainbow Books, Common Criteria, PCI, CMU CERT, UL, and U.S. Government and NIST standards
- Published in IEEE Security & Privacy, IEEE Software, ACM Proceedings and industry publications, and a frequent speaker who simplifies complex cybersecurity topics for the press and executives
Education
M.S. in Computer Science, Eastern Michigan University | B.S. in Computer Science, University of Louisiana at Lafayette