Practical Application of OpenSAMM Methodology in Software Development
Discussing the practical implementation of OpenSAMM methodology in software development, focusing on its application to different stages of the SDLC. The training session aims to address challenges faced in secure software development, with interactive discussions and best practices shared by industry experts.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
OpenSAMM Training Bart De Win Bart.DeWin@owasp.org Sebastien Deleersnyder seba@owasp.org OWASP AppSec EU 2014 Training, June 24
Bart / Seba ? Sebastien Deleersnyder Bart De Win, Ph.D. 15+ years developer / information security experience 15+ years experience in secure software development Belgian OWASP chapter founder Belgian OWASP chapter co-leader OWASP volunteer Author of >60 publications Co-organizer www.BruCON.org Security consultant PwC Application security specialist Toreon
This training ? Goal is to discuss how to apply OpenSAMM in practice Looking into different parts from a practical perspective Based on the case of your own company Discussing some of the challenges that you might face Open interaction session OWASP AppSec EU 2014 Training, June 24
Rules of the House 1. Turn off mobile phones 2. Interactive training 3. Specific discussions about company practices don t leave this room OWASP AppSec EU 2014 Training, June 24
Todays Agenda 1. Introduction to SDLC and OpenSAMM 2. Applying OpenSAMM Methodology Assessment Governance Assessment Construction Assessment Verification Assessment Deployment Setting Improvement Targets 3. OpenSAMM Tools 4. OpenSAMM Best Practices OWASP AppSec EU 2014 Training, June 24
Application Security Problem Software complexity Technology stacks Adaptability Requirements? Training 75% of vulnerabilities are application related Mobile Growing connectivity Better Faster Cloud OWASP AppSec EU 2014 Training, June 24
Application Security Symbiosis OWASP AppSec EU 2014 Training, June 24
Application Security during Software Development Analyse Design Implement Test Deploy Maintain Bugs Flaws Cost OWASP AppSec EU 2014 Training, June 24
The State-of-Practice in Secure Software Development Analyse Design Implement Test Deploy Maintain (Arch review) Pentest Penetrate & Patch Problematic, since: Focus on bugs, not flaws Penetration can cause major harm Not cost efficient No security assurance All bugs found ? Bug fix fixes all occurences ? (also future ?) Bug fix might introduce new security vulnerabilities OWASP AppSec EU 2014 Training, June 24
SDLC ? Analyse Design Implement Test Deploy Maintain SDLC Enterprise-wide software security improvement program Strategic approach to assure software quality Goal is to increase systematicity Focus on security functionality and security hygiene OWASP AppSec EU 2014 Training, June 24
SDLC Cornerstones People Roles & Responsibilities Activities Deliverables Control Gates Process Risk Training Standards & Guidelines Compliance Transfer methods Knowledge Development support Assessment tools Management tools Tools & Components SecAppDev 2013 OWASP AppSec EU 2014 Training, June 24
Strategic ? 1.Organizations with a proper SDLC will experience an 80 percent decrease in critical vulnerabilities 2.Organizations that acquire products and services with just a 50 percent reduction in vulnerabilities will reduce configuration management and incident response costs by 75 percent each. OWASP AppSec EU 2014 Training, June 24
Does it really work ? OWASP AppSec EU 2014 Training, June 24
SDLC-related initiatives TouchPoints Microsoft SDL SP800-64 CLASP SSE-CMM BSIMM TSP-Secure GASSP OWASP AppSec EU 2014 Training, June 24 SAMM
Why a Maturity Model ? Changes must be iterative while working toward long-term goals An organization s behavior changes slowly over time There is no single recipe that works for all organizations A solution must enable risk-based choices tailored to the organization Guidance related to security activities must be prescriptive A solution must provide enough details for non- security-people Overall, must be simple, well- defined, and measurable OWASP Software Assurance Maturity Model (SAMM) https://www.owasp.org/index.php/Category:Software_Assurance_Maturity_Model OWASP AppSec EU 2014 Training, June 24
OpenSAMM 101 Introduction to the model OWASP AppSec EU 2014 Training, June 24
SAMM Business Functions Start with the core activities tied to any organization performing software development Named generically, but should resonate with any developer or manager OWASP AppSec EU 2014 Training, June 24
SAMM Security Practices From each of the Business Functions, 3 Security Practices are defined The Security Practices cover all areas relevant to software security assurance Each one is a silo for improvement OWASP AppSec EU 2014 Training, June 24
Under each Security Practice Three successive Objectives under each Practice define how it can be improved over time This establishes a notion of a Level at which an organization fulfills a given Practice The three Levels for a Practice generally correspond to: (0: Implicit starting point with the Practice unfulfilled) 1: Initial understanding and ad hoc provision of the Practice 2: Increase efficiency and/or effectiveness of the Practice 3: Comprehensive mastery of the Practice at scale OWASP AppSec EU 2014 Training, June 24
Check out this one... OWASP AppSec EU 2014 Training, June 24
Per Level, SAMM defines... Objective Activities Results Success Metrics Costs Personnel Related Levels OWASP AppSec EU 2014 Training, June 24
Approach to iterative improvement Since the twelve Practices are each a maturity area, the successive Objectives represent the building blocks for any assurance program Simply put, improve an assurance program in phases by: Select security Practices to improve in next phase of assurance program Achieve the next Objective in each Practice by performing the corresponding Activities at the specified Success Metrics OWASP AppSec EU 2014 Training, June 24
Applying the model OWASP AppSec EU 2014 Training, June 24
Conducting assessments SAMM includes assessment worksheets for each Security Practice OWASP AppSec EU 2014 Training, June 24
Assessment process Supports both lightweight and detailed assessments Organizations may fall in between levels (+) OWASP AppSec EU 2014 Training, June 24
Creating Scorecards Gap analysis Capturing scores from detailed assessments versus expected performance levels Demonstrating improvement Capturing scores from before and after an iteration of assurance program build-out Ongoing measurement Capturing scores over consistent time frames for an assurance program that is already in place OWASP AppSec EU 2014 Training, June 24
Roadmap templates To make the building blocks usable, SAMM defines Roadmaps templates for typical kinds of organizations Independent Software Vendors Online Service Providers Financial Services Organizations Government Organizations Organization types chosen because They represent common use-cases Each organization has variations in typical software-induced risk Optimal creation of an assurance program is different for each OWASP AppSec EU 2014 Training, June 24
Todays Agenda 1.Introduction to SDLC and OpenSAMM 2.Applying OpenSAMM Methodology Assessment Governance Assessment Construction Assessment Verification Assessment Deployment Setting Improvement Targets 3.OpenSAMM Tools 4.OpenSAMM Best Practices OWASP AppSec EU 2014 Training, June 24
Before you begin Organizational Context Realistic Goals ? Scope ? Constraints (budget, timing, resources) Affinity with a particular model ? OWASP AppSec EU 2014 Training, June 24
Whats your Company Maturity ? In terms of IT strategy and application landscape In terms of software Development practices Analysis, Design, Implementation, Testing, Release, Maintenance In terms of ITSM practices Configuration, Change, Release, Vulnerability -Mngt. Company Maturity Feasibility SDLC Program OWASP AppSec EU 2014 Training, June 24
Complicating factors, anyone ? Different development teams Different technology stacks Business-IT alignment issues Outsourced development ... OWASP AppSec EU 2014 Training, June 24
Typical Approach As-Is To-Be Improvements OWASP AppSec EU 2014 Training, June 24
As-Is As-Is To-Be Improvements Maturity Evaluation (in your favourite model) Depending on (your knowledge of) the organisation, you might be able to do this on your own If not, interviews with different stakeholders will be necessary Analyst, Architect, Tech Lead, QA, Ops, Governance Discuss outcome with the stakeholders and present findings to the project advisory board OWASP AppSec EU 2014 Training, June 24
Scoping For large companies, teams will perform differently => difficult to come up with a single result Consider Reducing the scope to a single, uniform unit splitting the assessment into different organizational subunits Splitting might be awkward at first, but can be helpful later on for motivational purposes OWASP AppSec EU 2014 Training, June 24
Assessment Exercises Use OpenSAMM to evaluate the development practices in your own company Focus on a specific Business Functions Applicable to both Waterfall and Agile models Using distributed sheets and questionnaires OWASP AppSec EU 2014 Training, June 24
To-Be As-Is To-Be Improvements Identify the targets for your company Define staged roadmap and overall planning Define application migration strategy Gradual improvements work better than big bang Have this validated by the project advisory board OWASP AppSec EU 2014 Training, June 24
Staged Roadmap Security Practices/Phase Start One Two Three Strategy & metrics 0,5 2 2 2 Policy & Compliance 0 0,5 1 1,5 Education & Guidance 0,5 1 2 2,5 Threat Assessment 0 0,5 2 2,5 Security Requirements 0,5 1,5 2 3 Secure Architecture 0,5 1,5 2 3 Design Review 0 1 2 2,5 Code Review 0 0,5 1,5 2,5 Security Testing 0,5 1 1,5 2,5 Vulnerability 2,5 3 3 3 Management Environment Hardening 2,5 2,5 2,5 2,5 Operational Enablement 0,5 0,5 1,5 3 Total Effort per Phase 7,5 7,5 7,5 OWASP AppSec EU 2014 Training, June 24
Improvement Exercise Define a target for your company and the phased roadmap to get there Focus on the most urgent/heavy-impact practices first Try balancing the complexity and effort of the different step-ups OWASP AppSec EU 2014 Training, June 24
Implementation As-Is To-Be Improvements Implementation of dedicated activities according to the plan Iterative, Continuous Process Leverage good existing practices OWASP AppSec EU 2014 Training, June 24
Governance Business Function OWASP AppSec EU 2014 Training, June 24
Strategy & Metrics 1. Goal is to establish a software assurance framework within an organisation Foundation for all other OpenSAMM practices 2. Characteristics: Measurable Aligned with business risk 3. Driver for continuous improvement and financial guidance VS. OWASP AppSec EU 2014 Training, June 24
Strategy & Metrics OWASP AppSec EU 2014 Training, June 24
Policy & Compliance 1. Goal is to understand and adhere to legal and regulatory requirements Typically external in nature This is often a very informal practice in organisations ! 2. Characteristics Organisation-wide vs. project-specific Scope 3. Important driver for software security requirements OWASP AppSec EU 2014 Training, June 24
Policy & Compliance OWASP AppSec EU 2014 Training, June 24
Education & Guidance 1. Goal is to disseminate security-oriented information to all stakeholders involved in the software development lifecycle By means of standards, trainings, 2. To be integrated with organisation training curriculum A once-of effort is not sufficient Teach a fisherman to fish 3. Technical guidelines form the basis for several other practices OWASP AppSec EU 2014 Training, June 24
Education & Guidance OWASP AppSec EU 2014 Training, June 24
Assessment Exercise Use OpenSAMM to evaluate the development practices in your own company Focus on Governance Business Function Applicable to both Waterfall and Agile models Using distributed sheets and questionnaires OWASP AppSec EU 2014 Training, June 24
Assessment wrap-up What s your company s score ? What s the average scores for the group ? Any odd ratings ? OWASP AppSec EU 2014 Training, June 24
Construction Business Function OWASP AppSec EU 2014 Training, June 24
