OWASP Dashboard

Improve your Software Security posture with
SAMM 2.0 Dashboard
Tuesday, June 16, 2020

• Head of Research and Operations – National Cyber Defence Research
Sathish Ashwin Centre, India.
• Working with leading MNC’s on building cyber security strategy.
• Founder – The Cyber School, an NGO that serves less-privileged children by
teaching them latest technology, programming skills, artificial intelligence,
cyber security etc., and help them shape their personality and career.
• Worked and Trained – State and Central Governments, Legal and Law
enforcements agencies.
• Speaker at many National and Inter National Conferences.
• Mentored 20+ Startups.
• Help individuals on overcoming their cyber security issues and digital
psychological issues.
• Master’s in Cyber Security, Criminology and Psychology.
• Pursuing Phd in Neural Networks and Digital Psychology.
• Authored and co-authored 100+ international articles and 10+ books.
W h a t is S A M M ?
Measurable
Defined maturity levels
The Software Assurance Maturity Model across business practices
(SAMM) is an open framework that Actionable

provides an effective and measurable way Clear pathways for
improving maturity levels
for all types of organizations to analyze
Versatile
and improve their software security Technology, process, and
posture. organization agnostic
owaspsamm.org
SAM M 2.0
Governance Design Implementation Verification Operations
Strategy & Threat Architecture Incident

Secure Build
Metrics Assessment Management
Assessment
Policy & Security Secure Requirements- Environment
Compliance Requirements Deployment driven Testing
Management
Education & Secure Defect Operational
Architecture Security Testing
Guidance Management Management
SAMM Maturity Levels and Scoring
• Transparent view over different levels
• Fine-grained improvements are visible
Maturity levels Assessment scores
3 Comprehensive mastery at scale 1 Most
2 Increased efficiency and effectiveness 0.5 At least half
1 Ad-hoc provision 0.2 Some
0 Practice unfulfilled 0 None

Governance Design Implementation Verification Operations
Strategy & Threat Architecture Incident

Secure Build
Metrics Assessment Management
Create & Measure & App risk Threat Build
Assessment
Architecture
Architecture Incident Incident
Dependencies
promote improve profile process validation compliance detection response
model
Policy & Security Secure Requirements- Environment

Compliance Requirements Deployment driven Testing
Policy & Compliance Software Supplier Deployment Control Misuse/abuse
Management
Config Patch &
Secret mgmt
standards mgmt reqmts process verification testing hardening
security update
Education & Secure

Security Defect Operational
Security Testing
Guidance Architecture
Architectur Management Management
e
Training & Org & Architecture Technology Defect Metrics & Scalable Deep Data Legacy
awareness culture design mgmt tracking understanding protection mgmt
feedback baseline
Stream A Stream B Stream A Stream B Stream A Stream B Stream A Stream B Stream A Stream B
What was missing?
• Different dashboards
• Types of report
• It was always difficult in transferring data between multiple stakeholders.
• Instant notifications
• Integrating with your existing security roadmap.
• Large amount of time consumption to validate the artifacts submitted by the
respective stakeholders.
• Provide review feedbacks for the artifacts submitted.
• CONVENCING THE ENTIRE TEAM AND MANAGEMENT
Critical Success Factors
with SAMM 2.0
Dashboard
Automated Interviews, Task and Report Transfer
• Maturity scores can be produced by any users once onboarded to the portal
and the reviewer will verify the artifacts submitted by the user and confirm
the maturity score.
• Reports can be transferred to any number of users specified by the
organization through mail automatically rather than downloading the
reports manually.
• This enhances the ease of transferring data between multiple stakeholders.
Automated Scoring Mechanism
• Documents can be evaluated automatically and scorings can be provided
based on the artifacts submitted by the respective stakeholders.
• Automated evaluation of strategies employed by integration SAMM to the
existing security road map that it performs evaluation automatically on each
of the phases of strategy been employed and gets updated automatically in
the SAMM Software.
• Enormous time consumption to perform audit on the documents been
evaluated.
• An AI mechanism will be used to perform automated audit on the factors
once the artifacts have been evaluated.
Users, Dashboard and Reporting
• Create different types of users such as administrator, auditor, users.

• A Detailed Comparison Report can be generated on the documents been
uploaded for Analysis and for Audit-support Document for future Reference
and Analysis.
• Dashboard with multi-view and different maturity scores.
Would you like to contribute?
• Remediate the existing vulnerabilities and upgrade the dependency
libraries.
• Roadmap features.
• Notification feature.
• Integration with existing SDLC.
• Customized reporting.
• Artifacts review and automated scoring github.com/OWASP/samm
Q u e s ti o n s ?
Feedback?
T h a n k yo u !
Google – SathIsh AshwIn
sath9600@gmail.com
satihsh.ashwin@ncdrc.co.in
contact@thecyberschool.org
https://thecyberschool.org

OWASP Dashboard

Uploaded by

Copyright:

Available Formats

OWASP Dashboard

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

OWASP Dashboard

Uploaded by

Copyright:

Available Formats

Improve your Software Security posture with

SAMM 2.0 Dashboard

Tuesday, June 16, 2020

(SAMM) is an open framework that Actionable

Strategy & Threat Architecture Incident

Maturity levels Assessment scores

3 Comprehensive mastery at scale 1 Most

2 Increased eﬀiciency and eﬀectiveness 0.5 At least half

1 Ad-hoc provision 0.2 Some

0 Practice unfulfilled 0 None

Strategy & Threat Architecture Incident

Policy & Security Secure Requirements- Environment

Education & Secure

• Create different types of users such as administrator, auditor, users.

You might also like