  In its Vision and Strategy for Software for Science, Engineering, and
Education the NSF states that it will invest in activities that: "Recognize
that software strategies must include the secure and reliable deployment and
operation of services, for example by campuses or national facilities or
industry, where identity, authentication, authorization and assurance are
crucial operational capabilities." and "Result in high-quality, usable, secure,
vulnerability-free, sustainable, robust, well-tested, and
maintainable/evolvable software; and which promotes the sustainability of solid
and useful on-going investments."
  Such statements evidence that security should indeed be a first-class
consideration of the software ecosystem. In this position paper, we share some
thoughts related to research software security. Our thoughts are based on the
observation that security is not a binary, all-or-nothing attribute, but a
range of practices and requirements depending on how the software is expected
to be deployed and used. We propose that the community leverage the concept of
a maturity model, and work to agree on a research software security maturity
model. This model would categorize different sets of security needs of the
deployment community, and provide software developers a roadmap for advancing
the security maturity of their software. The intent of this paper is not to
express such a comprehensive maturity model, but instead to start a
conversation and set some initial requirements.
