Assess and Improve Your AppSec Programme using OWASP SAMM

One-Day Interactive (Classroom) Training - OWASP New Zealand Day 2022

Abstract

Incorporating a mix of lectures and workshops, this training delivers an in-depth view of and practical implementation of the OWASP Software Assurance Maturity Model (SAMM). SAMM provides an effective and measurable way for organisations to analyze and improve their software security posture.

Course Details

Dates: Tuesday, 5 July 2022

Time: 8:45 a.m. to 5:30 p.m. (NZDT)

Instructor: Raafey Khan, AppSec Services Team, Datacom

Course Fee: NZ $500.00 (plus GST and ticketing fees)

Registration Site: https://events.humanitix.com/owaspnz2022-training

Maximum Enrolment: 36 attendees

Course Description

Building security into the software development and management practices of an organisation can be a daunting task. There are many elements to the equation: organisation structure, different stakeholders, technology stacks, tools and processes, and so forth. Implementing software assurance can have a significant impact on the organization. Yet, trying to achieve this without a good framework is most likely leading to just marginal and unsustainable improvements. OWASP SAMM gives you a structural and measurable framework to do just that. It enables you to formulate and implement a strategy for software security that is tailored to the risk profile of your organisation.

The goal of this one-day training, which is conceived as a mix of presentations and interactive workshops, is for the participants to get a more in-depth view of, and practical feel for, the OWASP SAMM model. The training is set up in three parts:

In the first part, we present an overview of the model, and review the similarities and differences with other models. The five Business Functions - Governance, Design, Implementation, Verification, and Operations - are explained. Furthermore, different constituent elements (e.g., metrics) are discussed and the overall usage scenarios of the model are explained.
Next, approximately half a day will be spent doing an actual SAMM evaluation of your organisation (or one that you have worked for). We will go through an evaluation of all the SAMM domains and discuss the results in the group. This will give all participants a good indication of the organisation’s maturity in software assurance. In the same effort, we will define a target model for your organisation and identify the most important challenges in getting there.
The final part of the training will be dedicated to specific questions or challenges that you are facing about secure development in your organisation. In this group discussion, experiences will be shared among participants to address these questions.

In case you haven’t started a secure software initiative in your organisation yet, this training should provide you with the necessary foundations and ideas to do so. Be prepared for the highly effective and applicable treatment of this large domain!

And, in case you would be concerned about confidentiality issues, we adhere to the Chatham House Rule.

Course Topics

Part One: SDLC Overview and OWASP SAMM Introduction

The ‘Application Security Problem’
Software Development Lifecycle (SDLC) Overview
OWASP SAMM - Vision, History, Structure
OWASP SAMM As an Assessment Tool

Part Two: Applying OWASP SAMM

Methodology
Establishing Assessment Scope
Assessing Governance
Assessing Design
Assessing Implementation
Assessing Verification
Assessing Operations
Setting Improvement Targets

Part Three: OWASP SAMM Tools

Assessment Tools
- OWASP SAMM Toolkit (Excel workbook)
- SAMMwise (single-page application)
Benchmark Project
Relationships with Other SAMM Projects and Tools

Part Four: OWASP SAMM Best Practices

Choosing the Right Starting Points
Monitoring and Metrics
Achieving Security by Default
Critical Success Factors

Your Instructor

Raafey Khan

An eternal security optimist, Raafey has been helping organisations in NZ and the UK understand their cyber risk and why they should at least try to embed security into their development processes.

As a founding member of Datacom’s Application Security Services team, Raafey attempts to do more of the same for Datacom’s clients, with a real focus on automating everything and making security stupidly simple.