Pavel Radchuk - SAMM: Understanding Agile in Security

Video: https://youtu.be/nOrlK4p7QA8
OWASP Kyiv Winter 2017 Meetup, Dec 2, 2017
https://www.owasp.org/index.php/Kyiv

Transcript

1. OWASP SAMM:
   Understanding Agile in Security
   

   View Slide

2. Software development is…
   

   View Slide

3. Agile
   

   View Slide

4. Security methodologies for Agile
   

   View Slide

5. MS SDL for Agile
   MS Security Development Lifecycle (SDL) is a software
   development process that helps developers build more
   secure software and address security compliance
   requirements while reducing development cost
   

   View Slide

6. MS SDL for Agile
   

   View Slide

7. MS SDL for Agile
   

   View Slide

8. MS SDL for Agile
   

   View Slide

9. MS SDL is it THAT Agile?
   • Needs to be fully implemented
   • All functions are necessary
   • Doesn’t deal with business restrictions
   

   View Slide

10. OWASP SAMM
    The Software Assurance
    Maturity Model (SAMM) is
    an open framework to help
    organizations formulate and
    implement a strategy for
    software security that is
    tailored to the specific risks
    facing the organization
    

    View Slide

11. OWASP SAMM Framework
    

    View Slide

12. SAMM. Business function
    

    View Slide

13. SAMM. Business function
    • Objective
    • Activities
    • Assessment
    • Results
    • Success Metrics
    • Costs
    • Personnel
    • Related Levels
    

    View Slide

14. SAMM. Business function assessment
    

    View Slide

15. SAMM. Assessment via toolbox
    

    View Slide

16. SAMM. Defining goals
    

    View Slide

17. SAMM. Defining goals
    

    View Slide

18. SAMM. Reaching global goals
    

    View Slide

19. OWASP SAMM:
    What is next?
    

    View Slide

20. View Slide

21. Agile to devops toolbox
    

    View Slide

22. SAMM 2.0. Adjusting to devops
    SAMM
    Overview
    Business
    Function
    Security
    Practices
    Software Assurance
    Lifecycle
    Governance Construction Build & Deploy Verification Operations
    Threat
    Assessment
    Security
    Requirements
    Secure
    Architecture
    Strategy
    & Metrics
    Policy &
    Compliance
    Education &
    Guidance
    Issue
    Management
    Environment
    Hardening
    Operational
    Enablement
    Design
    Analysis
    Implementation
    Review
    Security
    Testing
    Secure
    Build
    Secure
    Deployment
    Defect
    Management
    

    View Slide

23. SAMM 2.0
    SAMM 2.0 is planned to be presented on OWASP 2018
    Summer Summit
    OWASP SAMM repository:
    https://github.com/OWASP/samm/tree/master/v2.0
    

    View Slide

24. SAMM. Get involved
    Special thanks to Yan Kravchenko – one of the SAMM
    developers
    If you want to contribute to the project or you just have
    some interesting opinions – contact OWASP members
    

    View Slide

25. Q&A
    

    View Slide