Jeff Johnson's CMM security model -- any pointers?

[genek () tripwiresecurity com (Gene Kim)]

Hey, all...

A couple of months back, I was talking with Karen Worstell, and she
mentioned some work that Jeff Johnson had done a while back, basically
creating something like a Security Capability Maturity Model.

Does anyone know where I can find a reference to this, and better yet, know
how to reach Jeff Johnson these days?  

The model was pretty interesting.  It reminds me of a presentation that I
saw from Stephen Katz about the Citicorp ISEM model, which measures the
security awareness of an organization, from complacency, awareness,
integration, measurement, and continual improvement.  (My paraphrase,
unfortunately...)

Thanks a bunch...

Cheers,
Gene

Gene Kim (mailto:genek () tripwiresecurity com)
Chief Technology Officer
Tripwire, Inc. (http://www.tripwiresecurity.com)
1631 NW Thurman St., 1st Floor
Portland, OR 97209
Office: 503-223-0280
Fax:    503-223-0182 

Tripwire in the news!
http://www.forbes.com/asap/html/99/0615/feat.htm

Tripwire is Linux World Security Editor's Choice!
http://www.wpi.com/linuxworld/lw-ec-winners.html