OWASP SAMM:
Understanding Agile in Security

Software development is…

Agile

Security methodologies for Agile

MS SDL for Agile
MS Security Development Lifecycle (SDL) is a software
development process that helps developers build more
secure software and address security compliance
requirements while reducing development cost

MS SDL for Agile

MS SDL for Agile

MS SDL for Agile

MS SDL is it THAT Agile?
• Needs to be fully implemented
• All functions are necessary
• Doesn’t deal with business restrictions

OWASP SAMM
The Software Assurance
Maturity Model (SAMM) is
an open framework to help
organizations formulate and
implement a strategy for
software security that is
tailored to the specific risks
facing the organization

OWASP SAMM Framework

SAMM. Business function

SAMM. Business function
• Objective
• Activities
• Assessment
• Results
• Success Metrics
• Costs
• Personnel
• Related Levels

SAMM. Business function assessment

SAMM. Assessment via toolbox

SAMM. Defining goals

SAMM. Defining goals

SAMM. Reaching global goals

OWASP SAMM:
What is next?

Agile to devops toolbox

SAMM 2.0. Adjusting to devops
SAMM
Overview
Business
Function
Security
Practices
Software Assurance
Lifecycle
Governance Construction Build & Deploy Verification Operations
Threat
Assessment
Security
Requirements
Secure
Architecture
Strategy
& Metrics
Policy &
Compliance
Education &
Guidance
Issue
Management
Environment
Hardening
Operational
Enablement
Design
Analysis
Implementation
Review
Security
Testing
Secure
Build
Secure
Deployment
Defect
Management

SAMM 2.0
SAMM 2.0 is planned to be presented on OWASP 2018
Summer Summit
OWASP SAMM repository:
https://github.com/OWASP/samm/tree/master/v2.0

SAMM. Get involved
Special thanks to Yan Kravchenko – one of the SAMM
developers
If you want to contribute to the project or you just have
some interesting opinions – contact OWASP members

Q&A