Downloaded 10 times
Uploaded byM S Sripati
NULL - OpenSAMM
This document provides an overview of the open Software Assurance Maturity Model (openSAMM). It explains that openSAMM is an open framework to help organizations formulate and implement a strategy for software security tailored to their specific risks. It describes openSAMM's four business functions and three security practices for each function. It outlines openSAMM's maturity levels and the objectives, activities, results, and metrics defined for each level. The document concludes with credits and information about the author.
More Related Content
NULL - OpenSAMM
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10.
- 11.
- 12. Classification system fora set of processes / function Shows characteristics of processes over different levels Examples CMMI (DEV, SVC, ACQ) SSE-CMM BSIMM, openSAMM, etc Maturity Models
- 14. Open Software AssuranceMaturity Model OWASP Project Open framework to help organizations Formulate Implement Strategy for software security Tailored to the specific risks facing the organization openSAMM
- 15. Recognizes 4 typeof business functions Any organization performing software development would have these (names could be different) openSAMM
- 16. 3 business practicesfor each function 3 objectives (for levels) under each practice 0 (implied starting point, not included) 1 (initial understanding and ad hoc provision of practice) 2 (increase efficiency / effectiveness of practice) 3 (comprehensive mastery of the practice) openSAMM - Security Practices
- 17.
- 18. For every level,SAMM defines Objective Activities Results Success Metrics Costs Personnel Related Levels openSAMM
- 19.
- 20.
- 21. Step 2 -Perform Gap Assessment
- 22. Step 3 -Create Roadmap / Assurance Program
- 23. Perform practices /activities for level 1 Keep assessing it till you are satisfied and the scorecard tells you to Inform management with the updated roadmap in a periodic manner Move to next level after you are done with the previous one Step 4 - Execute with periodic reviews
- 24.
- 25.
Editor's Notes
- #3 Talk about how this talk is going to benefit people who want to stay connected to security but are finding it difficult to do so in the absence of a formal transition (e.g., developer, tester, etc.). Also tell them how it is a very good thing to do if you want to jump onto the technical side of security but are currently in some other job that has little relationship with security
- #4 Ask them about what they think of this image, and get onto the different perceptions that everyone has for their work and its impact on the business (bottomline – every role / work is important towards client satisfaction, but no-one is ready to accept it, except business)
- #5 Ask everyone about their work, and how do they go about it … then move onto why it is a process (a way of doing things), and why any change in either of the three (people, process, and technology) results in a better client satisfaction
- #6 Talk about how many things have forced people to come to terms now that application security should be implemented from the beginning, and not patched in the end (otherwise money just piles up).
- #7 So it gives rise to SecureSDLCs. However, in the absence of a structured approach to implement it, and a way to measure our progress and benchmarking, management sometimes make unrealistic plans / schedules, which look like this:-
- #8 This is how managementusually expects people to implement security
- #9 Can you tell me what is lacking here (people, process or technology)?
- #10 Management View of secure SDLC