Loading…
AppSec California 2020, January 21-24 at the Annenberg Beach House, Santa Monica, CA
Friday, January 24 • 10:55am - 11:45am
OWASP SAMM2 - your dynamic software security journey

Sign up or log in to save this to your schedule and see who's attending!

Feedback form is now closed.
OWASP SAMM (https://owaspsamm.org) is the prime maturity model for software assurance that provides an effective and measurable way for all types of organizations to analyse and improve their software security posture. Building security into the software development and management practices of a company can be a daunting task. There are many elements to the equation: company structure, different stakeholders, technology stacks, tools and processes, and so forth. Implementing software assurance will have a significant impact on the organisation. Yet, trying to achieve this without a good framework is most likely leading to just marginal and unsustainable improvements. OWASP Software Assurance Maturity Model (SAMM) gives you a structural and measurable framework to do just that. It enables you to formulate and implement a strategy for software security that is tailored to the risk profile of your organisation. In this talk, we give an overview of the new release of the SAMM model. After 10 years since its first conception, it was important to align it with today’s development practices.

We will cover a number of topics in the talk: (i) the core structure of the model, which was redesigned and extended to align with modern development practices, (ii) the measurement model which was setup to cover both coverage and quality and (iii) the new security practice streams where the SAMM activities are grouped in maturity levels. We will demonstrate the new SAMM2 toolbox to measure the maturity of an example DevOps team and how you can create a roadmap of activities.

Latest version delivered: https://github.com/OWASP/samm/blob/master/Supporting%20Resources/presentations/OWASP%20SAMM2%20Talk%20Global%20AppSec%20AMS2019%20vfinal.pdf

Speakers
avatar for Brian Glas

Brian Glas

Assistant Professor of Computer Science, Union University
Brian Glas has worked in IT for over 18 years and information/application security for the last decade. He started as an enterprise Java developer, then transitioned to helping build an application security program as both tech lead and manager. He later played the role of enterprise... Read More →



Friday January 24, 2020 10:55am - 11:45am
Club Room