OWASP Projects and Application Security

  1. OWASP Software Assurance Maturity Model
    1. SAMM Framework Overview
      1. Maturity Model Concepts
        1. Business Function Organization
          1. Security Practice Structure
            1. Maturity Level Progression
            2. SAMM Business Functions
              1. Governance
                1. Strategy and Metrics
                  1. Establish Security Strategy
                    1. Measure Security Effectiveness
                      1. Demonstrate Security Value
                      2. Policy and Compliance
                        1. Create Security Policies
                          1. Manage Compliance Requirements
                            1. Monitor Policy Adherence
                            2. Education and Guidance
                              1. Provide Security Training
                                1. Develop Security Guidance
                                  1. Establish Security Culture
                                2. Design
                                  1. Threat Assessment
                                    1. Identify Application Threats
                                      1. Analyze Attack Vectors
                                        1. Assess Business Impact
                                        2. Security Requirements
                                          1. Define Security Requirements
                                            1. Specify Security Controls
                                              1. Manage Requirements Traceability
                                              2. Security Architecture
                                                1. Design Security Architecture
                                                  1. Implement Security Patterns
                                                    1. Validate Architecture Security
                                                  2. Implementation
                                                    1. Secure Build
                                                      1. Establish Build Standards
                                                        1. Implement Security Controls
                                                          1. Manage Build Dependencies
                                                          2. Secure Deployment
                                                            1. Define Deployment Process
                                                              1. Automate Security Checks
                                                                1. Manage Configuration Security
                                                                2. Defect Management
                                                                  1. Track Security Defects
                                                                    1. Implement Remediation Process
                                                                  2. Verification
                                                                    1. Architecture Assessment
                                                                      1. Review Security Architecture
                                                                        1. Validate Security Controls
                                                                          1. Assess Design Compliance
                                                                          2. Requirements-Driven Testing
                                                                            1. Test Security Requirements
                                                                              1. Validate Security Controls
                                                                                1. Measure Test Coverage
                                                                                2. Security Testing
                                                                                  1. Perform Security Testing
                                                                                    1. Automate Security Tests
                                                                                      1. Integrate Testing Pipeline
                                                                                    2. Operations
                                                                                      1. Incident Management
                                                                                        1. Establish Incident Response
                                                                                          1. Manage Security Events
                                                                                            1. Learn from Incidents
                                                                                            2. Environment Management
                                                                                              1. Harden Operating Environment
                                                                                                1. Monitor System Security
                                                                                                  1. Manage Environment Changes
                                                                                                  2. Operational Management
                                                                                                    1. Manage Operational Security
                                                                                                      1. Monitor Application Security
                                                                                                        1. Maintain Security Posture
                                                                                                    2. SAMM Assessment and Implementation
                                                                                                      1. Maturity Assessment Process
                                                                                                        1. Current State Assessment
                                                                                                          1. Gap Analysis
                                                                                                            1. Target State Definition
                                                                                                            2. Roadmap Development
                                                                                                              1. Priority Setting
                                                                                                                1. Resource Planning
                                                                                                                  1. Timeline Development
                                                                                                                  2. Implementation Tracking
                                                                                                                    1. Progress Monitoring
                                                                                                                      1. Metric Collection
                                                                                                                        1. Continuous Improvement

                                                                                                                    Previous

                                                                                                                    3. OWASP Application Security Verification Standard

                                                                                                                    Go to top

                                                                                                                    Next

                                                                                                                    5. OWASP Testing and Assessment Guides