https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=SdeleersnyderOWASP - User contributions [en]2026-04-17T17:17:48ZUser contributionsMediaWiki 1.27.2https://wiki.owasp.org/index.php?title=OWASP_BeNeLux-Days_2018&diff=255830OWASP BeNeLux-Days 20182019-10-31T13:42:35Z<p>Sdeleersnyder: </p>
<hr />
<div><center>[[Image:OBNL18 Banner v2.png]]</center><br />
<br />
<br><!-- Header --><br />
<br />
<br />
<!-- First tab --><br />
= Information =<br />
<br />
<p style="text-align:center">'''Thanks to all speakers and trainers, sponsors and volunteers who could make this 2018 edition a success.<br>'''</p><br />
<br />
Sad you missed the conference? No problem, just have a look at the {{#switchtablink:Conference_Day|video recordings}}!<br />
<br />
<br />
== Save the date ==<br />
<br />
<p style="text-align:center"><font color="red">'''In 2019 we will skip one year (we organised Global AppSec Amsterdam), See you next year in the Netherlands: 26 and 27 November 2020'''</font></p><br />
<br />
== Confirmed Conference Speakers ==<br />
<br />
<!--{{#switchtablink:Conference_Day|<p>--><br />
<br />
* David Scrobonia<br />
* Niels Tanis<br />
* Jeroen Willemsen<br />
* Björn Kimminich<br />
* Ralph Moonen<br />
* Jo Van Bulck<br />
* Lennert Wouters<br />
* Nick Drage<br />
<!--<br />
}}<br />
--><br />
<br />
== Confirmed Trainers ==<br />
<br />
<!--<br />
{{#switchtablink:Training Day|<p><br />
--><br />
* Andrew Martin<br />
* David Scrobonia<br />
* Jeroen Beckers - Stephanie Vanroelen<br />
<br />
<!--<br />
}}<br />
--><br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
The conference is closed.<br><br />
<br />
'''To support the OWASP organisation, consider to become a member, it's only US$50! Check out the [[Membership]] page to find out more.'''<br />
<br><br />
<br />
== The OWASP BeNeLux Program Committee ==<br />
<br />
* Sebastien Deleersnyder / Lieven Desmet / David Mathy / Thomas Herlea / Stella Dineva / Adolfo Solero / Bart De Win, [[Belgium|OWASP Belgium]]<br />
* Martin Knobloch / Joren Poll / Edwin Gozeling, [[Netherlands|OWASP Netherlands]]<br />
* [[Luxembourg|OWASP Luxembourg]]<br />
<br />
== Tweet! ==<br />
<br />
Event tag is [http://twitter.com/#search?q=%23owaspbnl17 #owaspbnl18]<br />
<br />
== Donate to OWASP BeNeLux ==<br />
<br />
[https://co.clickandpledge.com/?wid=72689 Donate]<br />
<br />
<!-- Second tab --><br />
= Registration =<br />
<br />
== Registration is closed ==<br />
<br />
'''To support the OWASP organisation, consider to become a member, it's only US$50! Check out the [[Membership]] page to find out more.''' <br />
<br />
<!-- Third tab --><br />
<br />
= Venue =<br />
<br />
== Address ==<br />
<br />
<table width="100%"><br />
<tr valign="top"><br />
<td width="50%"><br />
=== Training venue ===<br />
<br />
'''Novotel Mechelen Centrum'''<br />
Van Beethovenstraat 1<br />
2800 Mechelen<br />
Belgium<br />
<br />
[https://goo.gl/maps/WxErtbWADqC2 Google maps]<br />
</td><br />
<td width="50%"><br />
=== Conference venue ===<br />
<br />
'''Congres- en Erfgoedcentrum Lamot'''<br />
Van Beethovenstraat 8-10<br />
2800 Mechelen<br />
Belgium<br />
<br />
[https://goo.gl/maps/gZ9icR178w52 Google map]<br />
<br />
</td><br />
</tr><br />
</table><br />
<br /><br />
[[File:Mechelen-Lamot.jpg|350px|Lamot conference center]]<br />
[[File:Mechelen-lamot-center-auditorium.jpg|350px|Auditorium]]<br /><br />
<br />
<br />
<br />
Parking:<br /><br />
[[File:Parking lots around Lamot Conference center Mechelen.png|500px|Parking facilities]]<br /><br />
[https://goo.gl/maps/Q5TD7hoTuUu Find your parking on Google Maps]<br />
<br />
=== How to reach the venue? ===<br />
<br />
==== Public transport ====<br />
<br />
You can reach the Mechelen's train station from Antwerpen or Brussels.<br />
The Lamot conference center is 10 min away by bus (line 1).<br />
<br />
Or you can choose to walk for 15 min (1.2 km).<br />
<br />
<br />
==== By car ====<br />
<br />
===== From Brussels: =====<br />
Follow the E19 Brussels / Antwerpen and take the exit 10. <br> Follow the N1 until the R12 (take a left) and turn to the right at the "Brusselpoort" into the Hoogstraat to reach one of the parkings.<br />
<br />
===== From Antwerpen: =====<br />
Follow the E19 Brussels / Antwerpen and take the exit 9. <br> Follow the N16 until the R12 (take a right) and turn to the left at the "Brusselpoort" into the Hoogstraat to reach one of the parkings. <br />
<br />
<br />
=== Hotels Nearby ===<br />
[https://www.google.com/maps/d/viewer?mid=1eYMYmwXKuAsTilKgpAtyYtfMA7A&ll=51.02648134397288%2C4.47819800000002&z=15 Hotels around the Lamot conference center]<br />
<br />
<!-- Fourth tab --><br />
<br />
= Training Day =<br />
<br />
'''Training Day is November 29th'''<br />
<br />
== Training Venue ==<br />
<br />
The trainings will take place in the '''Novotel Mechelen Centrum''' hotel:<br><br />
Van Beethovenstraat 1<br><br />
2800 Mechelen<br><br />
[https://goo.gl/maps/WxErtbWADqC2 Google maps]<br />
<br />
== Agenda==<br />
<br />
{| class="wikitable"<br />
! Time !! Description !! Training 1 !! Training 2 !! Training 3<br />
|-<br />
! !! !! (Hof van Busleyden 1) !! (Hof van Busleyden 2) !! (Hof van Kamerijk) <br />
|-<br />
| 08h30 - 9h30<br />
| style="text-align: center; background: grey; color: white;" colspan="5" | ''Registration''<br />
|-<br />
| 09h30 - 11h00 || Training<br />
| style="width:100px;" rowspan="7" | [[#TRAINING_1 | Kubernetes security]] by Andrew Martin<br />
| style="width:100px;" rowspan="7" | [[#TRAINING_2 | OWASP Zap Training]] by David Scrobonia<br />
| style="width:100px;" rowspan="7" | [[#TRAINING_3 | Android security workshop]] by Jeroen Beckers & Stephanie Vanroelen<br />
|-<br />
| 11h00 - 11h30 || ''Coffee Break''<br />
|-<br />
| 11h30 - 13h00 || Training<br />
|-<br />
| 13h00 - 14h00 || ''Lunch''<br />
|-<br />
| 14h00 - 15h30 || Training<br />
|-<br />
| 15h30 - 16h00 || ''Coffee Break''<br />
|-<br />
| 16h00 - 17h30 || Training<br />
|}<br />
<br />
<font color="red">Choose the most appropriate training as they will be hosted at the same time.</font><br />
<br />
== Trainings ==<br />
<br />
=== <span id="TRAINING_1">Training 1 - Kubernetes security by Andrew Martin</span> ===<br />
<br />
==== Abstract ====<br />
<br />
===== Course Description =====<br />
The course guides attendees through Linux container security in general, and progresses to advanced Kubernetes cluster security. It emphasises pragmatic threat modelling and risk assessment based on an understanding of the tools and primitives available, rather than dogmatic dos and don’ts.<br />
<br />
===== Course Outline =====<br />
* How to attack containerised workloads<br />
* Enhanced container security<br />
* How to attack Kubernetes<br />
* Interactive production cluster hacking<br />
* Hardening Kubernetes<br />
* Locking down applications<br />
* Security tooling and vendor landscape<br />
<br />
===== Who Should Attend =====<br />
This course is suitable for intermediate to advanced Kubernetes users who want to strengthen their security understanding. It is particularly beneficial for those operating Kubernetes in a high-compliance domain, or for established security professionals looking to update their skills for the cloud native world.<br />
<br />
===== Participant requirements =====<br />
Just a laptop with an SSH client please, ssh or PuTTY.<br />
<br />
==== Bio ====<br />
<br />
Andrew has a strong test-first engineering ethos gained architecting and deploying high-traffic web applications. Proficient in systems development, testing, and maintenance, he is comfortable profiling and securing every tier of a bare metal or cloud native application, and has battle-hardened experience delivering containerised solutions to enterprise clients. He is a co-founder at https://control-plane.io<br />
<br />
=== <span id="TRAINING_2">Training 2 - OWASP Zap Training by David Scrobonia</span> ===<br />
<br />
==== Abstract ====<br />
<br />
This hands on course will start with the basics of using ZAP attack proxy and finish with leveraging it's API to integrate ZAP within you CI/CD processes. Along the way we will be practicing techniques by attacking the OWASP JuiceShop, an intentionally vulnerable web application. <br />
<br />
==== Audience ====<br />
<br />
This couse is designed for both new and experienced users. No knowledge or experience with ZAP is required, but even those familiar with ZAP will learn something new.<br />
<br />
==== Contents ====<br />
# Basic Techniques & Manual Testing <br />
# Advanced Techniques & Automated Testing<br />
# Scripting with ZAP<br />
# Using ZAP within your CI/CD Pipeline<br />
<br />
===== Participant requirements =====<br />
Please come prepared with the following tools installed:<br />
* ZAP (https://github.com/zaproxy/zaproxy/wiki/Downloads#zap-270-standard)<br />
* docker<br />
<br />
If you have any trouble with the setup please feel free to reach out to davidscrobonia at gmail with questions. <br />
<br />
==== Bio ====<br />
<br />
David Scrobonia is a part of the Security Engineering team at Segment working to secure modern web apps and AWS infrastructure. He contributes to open source in his spare time and is a core team member of the OWASP ZAP project.<br />
<br />
=== <span id="TRAINING_3">Training 3 - Android security workshop by Jeroen Beckers & Stephanie Vanroelen</span> ===<br />
<br />
==== Abstract ====<br />
<br />
In this workshop, participants will come in contact with the basics of<br />
Android application security. Through hands-on exercises, Jeroen and<br />
Stephanie will show which mistakes can be made, both at the design and<br />
implementation level, that can compromise the security of both the<br />
application and the backend server. Although no real prior experience<br />
with Android is needed, some basic knowledge on programming is advised.<br />
<br />
==== Participation requirements ====<br />
* Basic linux / terminal knowledge<br />
* Be able to understand the OWASP Top 10 (Not Mobile)<br />
* Laptop with VirtualBox / VMWare (At least 8GB of RAM)<br />
<br />
==== Bio ====<br />
<br />
Jeroen Beckers is a security researcher at NVISO. He focusses mainly on<br />
mobile applications for Android/iOS and sometimes even Windows Phone<br />
(yes, some people actually use it!). Apart from breaking mobile<br />
applications, he also gives security trainings and presentations at<br />
conferences.<br><br />
<br><br />
Stephanie Vanroelen is an IT security consultant currently focussing on Web and<br />
Mobile Application Security. Her experiences in organizing IT Security<br />
conferences such as BruCON and CyberSKool help her with project<br />
management and communication skills. In her free time she pretends to be<br />
Godzilla :).<br />
<br />
<br />
<br />
<!-- Fifth tab --><br />
= Conference Day =<br />
<br />
'''Conference Day is November 30th'''<br />
<br />
== Agenda ==<br />
<br />
{| class="wikitable"<br />
! width="120pt" | Time<br />
! width="190pt" | Speaker <br />
! width="400pt" | Topic<br />
! width="100pt" | Media<br />
|- <br />
| 08h30 - 09h15<br />
| style="text-align: center; background: grey; color: white" colspan="3" | ''Registration / [[#CyberWayFinder | Women in cybersecurity (CyberWayFinder)]]''<br />
|- <br />
| 09h15 - 09h30<br />
| style="text-align: center; background: grey; color: white" colspan="3" | ''Opening''<br />
|- <br />
| 09h30 - 10h15<br />
| [[#TALK_0930 | Lennert Wouters]]<br />
| [[#TALK_0930 | Fast, Furious and Insecure: Passive Keyless Entry and Start in Modern Supercars]]<br />
|<br />
|-<br />
| 10h15 - 11h00<br />
| [[#TALK_1015 | Ralph Moonen]]<br />
| [[#TALK_1015 | Weaknesses in our voice communications network: from Blue Boxing to VoLTE]]<br />
| [[Media:OWASP BeNeLux 2018 Ralph Moonen - Weaknesses in our voice communications network - from Blue Boxing to VoLTE compressed.pdf | Slides]]<br><br />
[https://youtu.be/Rl7VabjEd_A Video]<br />
|-<br />
| 11h00 - 11h30 <br />
| style="text-align: center;background: grey; color: white" colspan="3" | ''Morning Break'' <br />
|-<br />
| 11h30 - 12h15<br />
| [[#TALK_1130 | Niels Tanis]]<br />
| [[#TALK_1130 | When Serverless Met Security… Serverless Security & Functions-as-a-Service (FaaS)]]<br />
| [[Media:OWASP BeNeLux 2018 Niels Tanis - When Serverless Met Security.pdf | Slides]] <br><br />
[https://youtu.be/wuvGmXN0n6Q Video]<br />
|-<br />
| 12h15 - 13h00<br />
| [[#TALK_1215 | David Scrobonia]]<br />
| [[#TALK_1215 | OWASP Zap]]<br />
| [[Media:OWASP BeNeLux 2018 David Scrobonia OWASP Zap.pdf | Slides]]<br><br />
[https://youtu.be/iaZaPuQ6ams Video]<br />
|-<br />
| 13h00 - 14h00<br />
| style="text-align: center;background: grey; color: white" colspan="3" | ''Lunch'' <br />
|-<br />
| 14h00 - 14h45<br />
| [[#TALK_1400 | Björn Kimminich]]<br />
| [[#TALK_1400 | Juice Shop: OWASP's most broken Flagship]]<br />
| [[Media:OWASP BeNeLux 2018 Bjoern Kimminich - Juice Shop - OWASP's most broken Flagship.pdf | Slides]]<br><br />
[https://youtu.be/Lu0-kDdtVf4 Video]<br />
|-<br />
| 14h45 - 15h30<br />
| [[#TALK_1445 | Jo Van Bulck]]<br />
| [[#TALK_1445 | Leaky Processors: Stealing Your Secrets with Foreshadow]]<br />
| [[Media:OWASP BeNeLux 2018 Jo Van Bulck - Leaky Processors - Stealing Your Secrets with Foreshadow.pdf | Slides]] <br><br />
[https://youtu.be/le60NzmxU6s Video]<br />
|-<br />
| 15h30 - 16h00<br />
| style="text-align: center;background: grey; color: white" colspan="3" | ''Afternoon Break'' <br />
|-<br />
| 16h00 - 16h45<br />
| [[#TALK_1600 | Jeroen Willemsen]]<br />
| [[#TALK_1600 | Fast forwarding Mobile Security with the MSTG]]<br />
| [[Media:OWASP BeNeLux 2018 Jeroen Willemsen - Fast forwarding Mobile Security with the MSTG compressed.pdf | Slides ]]<br><br />
[https://youtu.be/WI2_cP48TnA Video]<br />
|-<br />
| 16h45 - 17h30<br />
| [[#TALK_1645 | Nick Drage]]<br />
| [[#TALK_1645 | Lessons from the legion (The OWASP BeNeLux Remix)]]<br />
| [[Media:OWASP BeNeLux 2018 Nick Drage - Lessons from the Legion compressed.pdf | Slides]]<br><br />
[https://youtu.be/516Z420BgkE Video]<br />
|-<br />
| 17h30 - 17h45<br />
| style="text-align: center;background: grey; color: white" colspan="3" | ''Closing'' <br />
|}<br />
<br />
== Talks == <br />
<br />
=== <span id="TALK_0930">Fast, Furious and Insecure: Passive Keyless Entry and Start in Modern Supercars by Lennert Wouters</span> ===<br />
<br />
==== Abstract ====<br />
<br />
The security of immobiliser and Remote Keyless Entry systems has been extensively studied over the past years. Passive Keyless Entry and Start systems, which are currently deployed in luxury vehicles, have not received as much attention.<br />
During this presentation we will share the techniques used in reverse engineering the Tesla Model S Passive Keyless Entry and Start system. We will discuss multiple security weaknesses in the system including the use of an inadequate proprietary cipher using 40-bit keys, the lack of mutual authentication in the challenge-response protocol, hardware configuration mistakes and the absence of security partitioning.<br><br />
We verified our findings by implementing a proof of concept attack allowing us to clone a Tesla Model S key fob in a matter of seconds with low cost commercial off the shelf equipment.<br><br />
Finally, we will share our experience with the responsible disclosure of these finding to Tesla Motors and other likely affected manufacturers such as McLaren, Karma Automotive and Triumph Motorcycles as they all use the same system developed by Pektron.<br />
<br />
====Bio====<br />
<br />
Lennert Wouters is a PhD researcher at the Computer Security and Industrial Cryptography (COSIC) research group at KU Leuven. His research interests involve hardware security of connected embedded devices and side channel attacks.<br />
<br />
=== <span id="TALK_1015">Weaknesses in our voice communications network: from Blue Boxing to VoLTE by Ralph Moonen</span> ===<br />
<br />
==== Abstract ====<br />
<br />
Voice over 4G, or VoLTE, brings back the phreaking 80's. Once again, after 3 decades, the signaling path of telephony is accessible to end users. No more R1, R2, C4 or C5 however: we now have SIP. As it turns out, the implementations of SIP and VoLTE in various European providers' 4G infrastructures, open up a host of possibilities. During our research over the past few years we have identified vulnerabilities in implementations such as txt message spoofing, subscriber enumeration, location determination (leakage of cell-ID and LAC), IMEI leakage and a potential SIM-card sharing attack.<br><br />
During this talk we will begin with a little historic stroll of phone phreaking through notable events and discoveries over the years. Bridging the narrative over the last few decades, new technologies such as VoIP, Volte, and VoWiFi are introduced, explaining the 4G and VoLTE infrastructure components and protocols. Next, on a rooted Android phone, we will show what control the user has over the VoLTE stack using some standard tools and the IPv6 stack. This includes hidden activities in Android and extraction of IPsec keys from the VoLTE stack. We will show that it is possible to import keys to Wireshark and monitor the IPv6 SIP traffic and components. Finally, examples of the vulnerabilities in implementations such as txt message spoofing, subscriber enumeration, location determination (leakage of cell-ID and LAC), IMEI leakage and a potential SIM-card sharing attack will be explained.<br><br />
Yes, a slightly technical nugget of knowledge, yet very accessible and a lot of fun!<br><br />
<br><br />
'''Importance of presentation for involved audience'''<br><br />
The phone systems of the world have always been of interest to everyone: from users who expect privacy, to intelligence agencies who want access. The privacy, integrity and confidentiality of voice communications over telecommunication networks is therefore of interest to anyone who uses mobile phones (i.e.: everyone). It is also typically a closed subject with very little research being done, relative to other security topics such as malware and application vulnerabilities. The combination of little research and high impact on everyone, makes that this topic deserves much more attention than it currently does. The VoLTE weaknesses we will describe are implementation dependent, and largely unpublished (i.e. new).<br />
<br />
==== Bio ====<br />
<br />
Ralph Moonen CISSP is Technical Director at Secura. Ralph is an old-school ethical hacker with 3 decades of experience as penetration tester, IT-auditor and security consultant. Now, as Technical Director, he is responsible for topics such as R&D and technical projects at Secura.<br />
<br />
=== <span id="TALK_1130">When Serverless Met Security… Serverless Security & Functions-as-a-Service (FaaS) by Niels Tanis</span> ===<br />
<br />
==== Abstract ====<br />
<br />
Serverless is a design pattern for writing scalable applications in which Functions as a Service (FaaS) is one of the key building blocks. Every mayor Cloud Provider has got his own FaaS available. On Microsoft Azure there is Azure Functions, AWS has got Lambda and Cloud Functions can be used on the Google Cloud. All of these have a lot of similarities in the way they allow developers to create small event driven services. <br><br />
From security perspective there are a lot of benefits when moving to a serverless architecture. There is no need to manage any of the machines and the underlying infrastructure. Dealing with updates, patches and infrastructure is the responsibility of the platform provider. FaaS are short lived processes which will be instantiated and destroyed in a matter of milliseconds making it more resilient to denial-of-services (DoS) and also makes it harder to attack and compromise. <br><br />
But will all of this be sufficient to be ’secure’ or should we be worried about more? With serverless there is still a piece of software that will be developed, build, deployed and executed. It will also introduce a more complex architecture with corresponding attack surface which also makes it hard to monitor. What about the software supply chain and delivery pipeline? There still will be a need to patch your software for vulnerabilities in code and used 3rd party libraries. In this talk we will identify the security area’s we do need to focus on when developing serverless and define possible solutions for dealing with those problems.<br />
<br />
==== Bio ====<br />
<br />
Niels Tanis has got a background in .NET development, pentesting and security consultancy. He also holds the CSSLP certification and has been involved in breaking, defending and building secure applications. He joined Veracode in 2015 and right now he works as a security researcher on a variant of languages and technologies related to Veracode’s Binary Static Analysis service. He is married, father of 2 and lives in a small village just outside Amersfoort, The Netherlands.<br />
<br />
<br />
=== <span id="TALK_1215">OWASP Zap by David Scrobonia</span> ===<br />
<br />
==== Abstract ====<br />
<br />
Intoducing security testing tools to a QA or developers workflow can be difficult when the tools aren't easy or intuitive to use. Even for security professionals, the friction of cumbersome security tooling can prevent them from getting the most from a tool or being effective with their time.<br><br />
The OWASP ZAP team is working to help enable developers, QA, and hackers alike with the ZAP Heads Up Display, a more user friendly way to engage with the security testing tool. The Heads Up Displays integrates ZAP directly in the browser providing all of the funcitonality of the tool via a heads up display. The goal is to make ZAP more accessible and enabling users, especially developers, to integrate security in their daily workflows.<br><br />
This talk will discuss the importance of usable tools, design tradeoffs made to improve usability, the various browser technologies powering the HUD, and how you can start hacking with a heads up display.<br />
<br />
==== Bio ====<br />
<br />
David Scrobonia is a part of the Security Engineering team at Segment working to secure modern web apps and AWS infrastructure. He contributes to open source in his spare time and is a core team member of the OWASP ZAP project.<br />
<br />
<br />
=== <span id="TALK_1400">Juice Shop: OWASP's most broken Flagship by Björn Kimminich</span> ===<br />
<br />
==== Abstract ====<br />
<br />
OWASP Juice Shop is an intentionally insecure webapp for security trainings written entirely in Javascript which encompasses the entire OWASP Top Ten and many more severe security flaws. In this talk, you'll learn about this open-source project and its capabilities first-hand from its creator. Join a “happy shopper round trip,” enjoy a hacking demo of some of the built-in challenges, witness how to re-theme the Juice Shop into a security awareness booster for your own company, and learn how to set it up for a capture-the-flag (CTF) event in less than 5 minutes!<br />
<br />
====Bio====<br />
<br />
Björn Kimminich is responsible for global IT architecture and application security at Kuehne + Nagel. On the side, he gives IT security lectures at the non-profit private university Nordakademie. Björn also is the project leader of the OWASP Juice Shop and a board member for the German OWASP chapter. <br><br />
[[File:GitHub-Mark_no_background.png|25px|link=https://github.com/bkimminich|GitHub]]<br />
[[File:TwitterLogo.png|25px|link=http://twitter.com/bkimminich|Twitter]]<br />
[[File:LinkedinSquareLogo.png|25px|link=https://www.linkedin.com/in/bkimminich|LinkedIn]]<br />
<br />
<br />
=== <span id="TALK_1445">Leaky Processors: Stealing Your Secrets with Foreshadow by Jo Van Bulck</span> ===<br />
<br />
==== Abstract ====<br />
<br />
For decades, memory isolation has been one of the key principles of<br />
secure system design. The recent wave of speculative execution attacks,<br />
including Meltdown, Spectre, and Foreshadow abruptly showed, however,<br />
that performance optimizations in modern processors fundamentally<br />
undermine application security.<br><br />
This talk will review how speculative execution attacks work. What makes<br />
them dangerous, and why they require a paradigm shift in the way we<br />
think about application security. The talk will have a special focus on<br />
the recently disclosed Foreshadow CPU vulnerability, which led to a<br />
complete collapse of state-of-the-art Intel SGX technology, and<br />
necessitated hardware and software patches for all major operating<br />
systems and virtual machine hypervisors.<br />
<br />
==== Bio ====<br />
<br />
Jo Van Bulck is a PhD researcher at imec-DistriNet, KU Leuven, where he<br />
investigates hardware-level trusted computing from an integrated attack<br />
and defense perspective. His work resulted in a.o., the high-impact<br />
Foreshadow CPU vulnerability announced in August 2018, and several<br />
open-source secure processor prototypes.<br />
<br />
<br />
=== <span id="TALK_1600">Fast forwarding Mobile Security with the MSTG by Jeroen Willemsen</span> ===<br />
<br />
==== Abstract ====<br />
<br />
After the startup of the mobile security project in 2010, the mobile security project and its testing guides have seen quiet some evolution. All of this changed quiet intensively when, in 2016, the Mobile Application Security Verification Standard (MASVS) and the Mobile Application Security Testing Guide (MSTG) were created. Now, two years fast forward: where are we now? How can you use it as a pentester or a developer? We will start with introducing the current state of the MSTG and its side-projects and then show various demos on iOS.<br><br />
<br />
==== Bio ====<br />
<br />
Jeroen Willemsen is a Principal Security Architect at Xebia. With a love for mobile security, he recently became one of the projectleaders for the OMTG project (MASVS & MSTG). Jeroen is more or less a jack of all trades with interest in infrastructure security, risk management and application security.<br />
<br />
=== <span id="TALK_1645">Lessons From The Legion (The OWASP BeNeLux Remix) by Nick Drage</span> ===<br />
<br />
==== Abstract ====<br />
<br />
Look at your job, your colleagues, your industry. Very smart people, working very hard... and yet it feels like we're losing.<br><br />
<br><br />
''Why?''<br><br />
<br><br />
Cyber security has always been a technology driven, engineer led industry - self-taught practitioners have chosen tactics and point solutions based on what fits in with their preferred ways of working and studying. We need better strategies to make use of those tactics. We can learn those strategies from other contexts and conflicts to improve our own methods and practices.<br><br />
<br><br />
''Would you like to start winning?''<br />
====Bio====<br />
<br />
Nick is the Director of Path Dependence Limited, and has over two decades of experience in the cyber security field… previously he was "SecOps” before the term was invented, as well as having been a SysAdmin, PCI QSA, pre-sales analyst, CHECK Team Leader, and various other less well defined roles. Nick is currently a Cyber Security Consultant and Penetration Tester, with occasional forays into being a Wargame Umpire, Adversarial Analyst, or Professional Wildcard.<br />
<br />
=== <span id="CyberWayFinder">Women in cybersecurity (CyberWayFinder)</span> ===<br />
OWASP BeNeLux and CyberWayFinder would like to invite you to a '''breakfast with other women in cybersecurity'''.<br><br />
Since women make up 7% of the cybersecurity work force, they are a rare breed, and don't often meet each other. That is why "women in cybersecurity breakfasts" are popping up in conferences around the world.<br />
A small gathering with the women who will be present at our OWASP conference in the morning provides an excellent network opportunity to meet one another. We'll make sure you don't start out the day on an empty stomach, and provide you with some contacts, without missing out on the rest of the conference.<br><br />
join us as of 08h30 at Lamot conference center, and also hear about the CyberWayFinder training program which is being created to help women transition their career into cybersecurity.<br><br />
<br />
<!-- Sixth tab --><br />
<br />
= Social Event =<br />
<br />
'''The Social Event is on Thursday, November 29th'''<br />
<br />
The social event will be a unique opportunity to meet some of the trainers and speakers, as well the organisers or even peers.<br><br><br />
<br />
The social event will take place in restaurant [http://www.puro-mechelen.be/english Puro Mechelen], a couple of minutes from the conference center, on Thursday 29/11 at 19h00.<br><br><br />
There is a fixed group menu (meat or fish) for '''59€/person''', drinks included.<br><br><br />
Link to the [https://static1.squarespace.com/static/53bedc63e4b051fad94ee1f7/t/59b7d81ea803bbc8f65d85ee/1505220639318/Puro-groepsmenu.pdf Menus] (page 1), and the [https://static1.squarespace.com/static/53bedc63e4b051fad94ee1f7/t/54b57100e4b0ab0673e80e8d/1421177088856/drankenformules.doc.pdf drinks].<br />
<br><br />
<br />
'''Any participant pays individually. <br>Reservation via the form you'll receive after conference registration is mandatory.'''<br><br />
<br />
<br />
<!--<br />
Address: TBD<br />
<br />
Menu:TBD<br />
--><br />
<!-- Seventh tab --><br />
= Sponsor =<br />
<br />
''' Become a sponsor of OWASP BeNeLux! '''<br />
<br />
There are 3 combined sponsorship packages (Gold, Silver or Bronze) that cover the BeNeLux chapter meetings 2019 and the BeNeLux OWASP Days 2018.<br />
<br />
Download our [https://www.owasp.org/images/8/8e/OWASP_BeNeLux_2018_Sponsorship_Form_v20181004.pdf sponsor brochure] and contact [mailto:seba@owasp.org us] for questions or sponsorship confirmation!<br />
<br />
Your sponsorship will be invested directly in the chapter meetings, supporting speaker and catering expenses. <br />
<br />
The sponsorship will also be dedicated to cover the costs of the OWASP 2018 BeNeLux event.<br />
<br />
<!-- Don't remove these two lines! -->__NOTOC__ <br />
<headertabs></headertabs><br />
<br />
=== Made possible by our {{#switchtablink:Sponsor|Sponsors}}===<br />
<br />
==== Gold ====<br />
<br />
[[File:DavinsiLabs.png|250px|link=https://www.davinsilabs.com]]<br />
[[File:Vest.jpg|250px|link=http://www.vest.nl]]<br />
<br />
<br />
==== Silver ====<br />
<br />
[[File:LogoIngenicoGroup.png|250px|link=https://ingenico.be]]<br />
[[File:LogoToreon.jpg|250px|link=https://www.toreon.com]] <br />
[[File:LogoSynopsys.png|250px|link=https://www.synopsys.com]]<br />
[[File:Nviso_logo_RGB_baseline_200px.png|250px|link=http://www.nviso.be]] <br />
<br />
<br />
<br />
==== Bronze ====<br />
<br />
[[File:Logo_Informatiebeveiliging-200.png|250px|link=https://informatiebeveiliging.nl/]]<br />
<br />
[[Category:OWASP_AppSec_Conference]] <br />
[[Category:OWASP_BeNeLux_Archives]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_BeNeLux-Days_2018&diff=255829OWASP BeNeLux-Days 20182019-10-31T13:42:14Z<p>Sdeleersnyder: </p>
<hr />
<div><center>[[Image:OBNL18 Banner v2.png]]</center><br />
<br />
<br><!-- Header --><br />
<br />
<br />
<!-- First tab --><br />
= Information =<br />
<br />
<p style="text-align:center">'''Thanks to all speakers and trainers, sponsors and volunteers who could make this 2018 edition a success.<br>'''</p><br />
<br />
Sad you missed the conference? No problem, just have a look at the {{#switchtablink:Conference_Day|video recordings}}!<br />
<br />
<br />
== Save the date ==<br />
<br />
<p style="text-align:center"><font color="red">'''In 2019 we will skip one year (we organised Global AppSec Amsterdam, See you next year in the Netherlands: 26 and 27 November 2020'''</font></p><br />
<br />
== Confirmed Conference Speakers ==<br />
<br />
<!--{{#switchtablink:Conference_Day|<p>--><br />
<br />
* David Scrobonia<br />
* Niels Tanis<br />
* Jeroen Willemsen<br />
* Björn Kimminich<br />
* Ralph Moonen<br />
* Jo Van Bulck<br />
* Lennert Wouters<br />
* Nick Drage<br />
<!--<br />
}}<br />
--><br />
<br />
== Confirmed Trainers ==<br />
<br />
<!--<br />
{{#switchtablink:Training Day|<p><br />
--><br />
* Andrew Martin<br />
* David Scrobonia<br />
* Jeroen Beckers - Stephanie Vanroelen<br />
<br />
<!--<br />
}}<br />
--><br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
The conference is closed.<br><br />
<br />
'''To support the OWASP organisation, consider to become a member, it's only US$50! Check out the [[Membership]] page to find out more.'''<br />
<br><br />
<br />
== The OWASP BeNeLux Program Committee ==<br />
<br />
* Sebastien Deleersnyder / Lieven Desmet / David Mathy / Thomas Herlea / Stella Dineva / Adolfo Solero / Bart De Win, [[Belgium|OWASP Belgium]]<br />
* Martin Knobloch / Joren Poll / Edwin Gozeling, [[Netherlands|OWASP Netherlands]]<br />
* [[Luxembourg|OWASP Luxembourg]]<br />
<br />
== Tweet! ==<br />
<br />
Event tag is [http://twitter.com/#search?q=%23owaspbnl17 #owaspbnl18]<br />
<br />
== Donate to OWASP BeNeLux ==<br />
<br />
[https://co.clickandpledge.com/?wid=72689 Donate]<br />
<br />
<!-- Second tab --><br />
= Registration =<br />
<br />
== Registration is closed ==<br />
<br />
'''To support the OWASP organisation, consider to become a member, it's only US$50! Check out the [[Membership]] page to find out more.''' <br />
<br />
<!-- Third tab --><br />
<br />
= Venue =<br />
<br />
== Address ==<br />
<br />
<table width="100%"><br />
<tr valign="top"><br />
<td width="50%"><br />
=== Training venue ===<br />
<br />
'''Novotel Mechelen Centrum'''<br />
Van Beethovenstraat 1<br />
2800 Mechelen<br />
Belgium<br />
<br />
[https://goo.gl/maps/WxErtbWADqC2 Google maps]<br />
</td><br />
<td width="50%"><br />
=== Conference venue ===<br />
<br />
'''Congres- en Erfgoedcentrum Lamot'''<br />
Van Beethovenstraat 8-10<br />
2800 Mechelen<br />
Belgium<br />
<br />
[https://goo.gl/maps/gZ9icR178w52 Google map]<br />
<br />
</td><br />
</tr><br />
</table><br />
<br /><br />
[[File:Mechelen-Lamot.jpg|350px|Lamot conference center]]<br />
[[File:Mechelen-lamot-center-auditorium.jpg|350px|Auditorium]]<br /><br />
<br />
<br />
<br />
Parking:<br /><br />
[[File:Parking lots around Lamot Conference center Mechelen.png|500px|Parking facilities]]<br /><br />
[https://goo.gl/maps/Q5TD7hoTuUu Find your parking on Google Maps]<br />
<br />
=== How to reach the venue? ===<br />
<br />
==== Public transport ====<br />
<br />
You can reach the Mechelen's train station from Antwerpen or Brussels.<br />
The Lamot conference center is 10 min away by bus (line 1).<br />
<br />
Or you can choose to walk for 15 min (1.2 km).<br />
<br />
<br />
==== By car ====<br />
<br />
===== From Brussels: =====<br />
Follow the E19 Brussels / Antwerpen and take the exit 10. <br> Follow the N1 until the R12 (take a left) and turn to the right at the "Brusselpoort" into the Hoogstraat to reach one of the parkings.<br />
<br />
===== From Antwerpen: =====<br />
Follow the E19 Brussels / Antwerpen and take the exit 9. <br> Follow the N16 until the R12 (take a right) and turn to the left at the "Brusselpoort" into the Hoogstraat to reach one of the parkings. <br />
<br />
<br />
=== Hotels Nearby ===<br />
[https://www.google.com/maps/d/viewer?mid=1eYMYmwXKuAsTilKgpAtyYtfMA7A&ll=51.02648134397288%2C4.47819800000002&z=15 Hotels around the Lamot conference center]<br />
<br />
<!-- Fourth tab --><br />
<br />
= Training Day =<br />
<br />
'''Training Day is November 29th'''<br />
<br />
== Training Venue ==<br />
<br />
The trainings will take place in the '''Novotel Mechelen Centrum''' hotel:<br><br />
Van Beethovenstraat 1<br><br />
2800 Mechelen<br><br />
[https://goo.gl/maps/WxErtbWADqC2 Google maps]<br />
<br />
== Agenda==<br />
<br />
{| class="wikitable"<br />
! Time !! Description !! Training 1 !! Training 2 !! Training 3<br />
|-<br />
! !! !! (Hof van Busleyden 1) !! (Hof van Busleyden 2) !! (Hof van Kamerijk) <br />
|-<br />
| 08h30 - 9h30<br />
| style="text-align: center; background: grey; color: white;" colspan="5" | ''Registration''<br />
|-<br />
| 09h30 - 11h00 || Training<br />
| style="width:100px;" rowspan="7" | [[#TRAINING_1 | Kubernetes security]] by Andrew Martin<br />
| style="width:100px;" rowspan="7" | [[#TRAINING_2 | OWASP Zap Training]] by David Scrobonia<br />
| style="width:100px;" rowspan="7" | [[#TRAINING_3 | Android security workshop]] by Jeroen Beckers & Stephanie Vanroelen<br />
|-<br />
| 11h00 - 11h30 || ''Coffee Break''<br />
|-<br />
| 11h30 - 13h00 || Training<br />
|-<br />
| 13h00 - 14h00 || ''Lunch''<br />
|-<br />
| 14h00 - 15h30 || Training<br />
|-<br />
| 15h30 - 16h00 || ''Coffee Break''<br />
|-<br />
| 16h00 - 17h30 || Training<br />
|}<br />
<br />
<font color="red">Choose the most appropriate training as they will be hosted at the same time.</font><br />
<br />
== Trainings ==<br />
<br />
=== <span id="TRAINING_1">Training 1 - Kubernetes security by Andrew Martin</span> ===<br />
<br />
==== Abstract ====<br />
<br />
===== Course Description =====<br />
The course guides attendees through Linux container security in general, and progresses to advanced Kubernetes cluster security. It emphasises pragmatic threat modelling and risk assessment based on an understanding of the tools and primitives available, rather than dogmatic dos and don’ts.<br />
<br />
===== Course Outline =====<br />
* How to attack containerised workloads<br />
* Enhanced container security<br />
* How to attack Kubernetes<br />
* Interactive production cluster hacking<br />
* Hardening Kubernetes<br />
* Locking down applications<br />
* Security tooling and vendor landscape<br />
<br />
===== Who Should Attend =====<br />
This course is suitable for intermediate to advanced Kubernetes users who want to strengthen their security understanding. It is particularly beneficial for those operating Kubernetes in a high-compliance domain, or for established security professionals looking to update their skills for the cloud native world.<br />
<br />
===== Participant requirements =====<br />
Just a laptop with an SSH client please, ssh or PuTTY.<br />
<br />
==== Bio ====<br />
<br />
Andrew has a strong test-first engineering ethos gained architecting and deploying high-traffic web applications. Proficient in systems development, testing, and maintenance, he is comfortable profiling and securing every tier of a bare metal or cloud native application, and has battle-hardened experience delivering containerised solutions to enterprise clients. He is a co-founder at https://control-plane.io<br />
<br />
=== <span id="TRAINING_2">Training 2 - OWASP Zap Training by David Scrobonia</span> ===<br />
<br />
==== Abstract ====<br />
<br />
This hands on course will start with the basics of using ZAP attack proxy and finish with leveraging it's API to integrate ZAP within you CI/CD processes. Along the way we will be practicing techniques by attacking the OWASP JuiceShop, an intentionally vulnerable web application. <br />
<br />
==== Audience ====<br />
<br />
This couse is designed for both new and experienced users. No knowledge or experience with ZAP is required, but even those familiar with ZAP will learn something new.<br />
<br />
==== Contents ====<br />
# Basic Techniques & Manual Testing <br />
# Advanced Techniques & Automated Testing<br />
# Scripting with ZAP<br />
# Using ZAP within your CI/CD Pipeline<br />
<br />
===== Participant requirements =====<br />
Please come prepared with the following tools installed:<br />
* ZAP (https://github.com/zaproxy/zaproxy/wiki/Downloads#zap-270-standard)<br />
* docker<br />
<br />
If you have any trouble with the setup please feel free to reach out to davidscrobonia at gmail with questions. <br />
<br />
==== Bio ====<br />
<br />
David Scrobonia is a part of the Security Engineering team at Segment working to secure modern web apps and AWS infrastructure. He contributes to open source in his spare time and is a core team member of the OWASP ZAP project.<br />
<br />
=== <span id="TRAINING_3">Training 3 - Android security workshop by Jeroen Beckers & Stephanie Vanroelen</span> ===<br />
<br />
==== Abstract ====<br />
<br />
In this workshop, participants will come in contact with the basics of<br />
Android application security. Through hands-on exercises, Jeroen and<br />
Stephanie will show which mistakes can be made, both at the design and<br />
implementation level, that can compromise the security of both the<br />
application and the backend server. Although no real prior experience<br />
with Android is needed, some basic knowledge on programming is advised.<br />
<br />
==== Participation requirements ====<br />
* Basic linux / terminal knowledge<br />
* Be able to understand the OWASP Top 10 (Not Mobile)<br />
* Laptop with VirtualBox / VMWare (At least 8GB of RAM)<br />
<br />
==== Bio ====<br />
<br />
Jeroen Beckers is a security researcher at NVISO. He focusses mainly on<br />
mobile applications for Android/iOS and sometimes even Windows Phone<br />
(yes, some people actually use it!). Apart from breaking mobile<br />
applications, he also gives security trainings and presentations at<br />
conferences.<br><br />
<br><br />
Stephanie Vanroelen is an IT security consultant currently focussing on Web and<br />
Mobile Application Security. Her experiences in organizing IT Security<br />
conferences such as BruCON and CyberSKool help her with project<br />
management and communication skills. In her free time she pretends to be<br />
Godzilla :).<br />
<br />
<br />
<br />
<!-- Fifth tab --><br />
= Conference Day =<br />
<br />
'''Conference Day is November 30th'''<br />
<br />
== Agenda ==<br />
<br />
{| class="wikitable"<br />
! width="120pt" | Time<br />
! width="190pt" | Speaker <br />
! width="400pt" | Topic<br />
! width="100pt" | Media<br />
|- <br />
| 08h30 - 09h15<br />
| style="text-align: center; background: grey; color: white" colspan="3" | ''Registration / [[#CyberWayFinder | Women in cybersecurity (CyberWayFinder)]]''<br />
|- <br />
| 09h15 - 09h30<br />
| style="text-align: center; background: grey; color: white" colspan="3" | ''Opening''<br />
|- <br />
| 09h30 - 10h15<br />
| [[#TALK_0930 | Lennert Wouters]]<br />
| [[#TALK_0930 | Fast, Furious and Insecure: Passive Keyless Entry and Start in Modern Supercars]]<br />
|<br />
|-<br />
| 10h15 - 11h00<br />
| [[#TALK_1015 | Ralph Moonen]]<br />
| [[#TALK_1015 | Weaknesses in our voice communications network: from Blue Boxing to VoLTE]]<br />
| [[Media:OWASP BeNeLux 2018 Ralph Moonen - Weaknesses in our voice communications network - from Blue Boxing to VoLTE compressed.pdf | Slides]]<br><br />
[https://youtu.be/Rl7VabjEd_A Video]<br />
|-<br />
| 11h00 - 11h30 <br />
| style="text-align: center;background: grey; color: white" colspan="3" | ''Morning Break'' <br />
|-<br />
| 11h30 - 12h15<br />
| [[#TALK_1130 | Niels Tanis]]<br />
| [[#TALK_1130 | When Serverless Met Security… Serverless Security & Functions-as-a-Service (FaaS)]]<br />
| [[Media:OWASP BeNeLux 2018 Niels Tanis - When Serverless Met Security.pdf | Slides]] <br><br />
[https://youtu.be/wuvGmXN0n6Q Video]<br />
|-<br />
| 12h15 - 13h00<br />
| [[#TALK_1215 | David Scrobonia]]<br />
| [[#TALK_1215 | OWASP Zap]]<br />
| [[Media:OWASP BeNeLux 2018 David Scrobonia OWASP Zap.pdf | Slides]]<br><br />
[https://youtu.be/iaZaPuQ6ams Video]<br />
|-<br />
| 13h00 - 14h00<br />
| style="text-align: center;background: grey; color: white" colspan="3" | ''Lunch'' <br />
|-<br />
| 14h00 - 14h45<br />
| [[#TALK_1400 | Björn Kimminich]]<br />
| [[#TALK_1400 | Juice Shop: OWASP's most broken Flagship]]<br />
| [[Media:OWASP BeNeLux 2018 Bjoern Kimminich - Juice Shop - OWASP's most broken Flagship.pdf | Slides]]<br><br />
[https://youtu.be/Lu0-kDdtVf4 Video]<br />
|-<br />
| 14h45 - 15h30<br />
| [[#TALK_1445 | Jo Van Bulck]]<br />
| [[#TALK_1445 | Leaky Processors: Stealing Your Secrets with Foreshadow]]<br />
| [[Media:OWASP BeNeLux 2018 Jo Van Bulck - Leaky Processors - Stealing Your Secrets with Foreshadow.pdf | Slides]] <br><br />
[https://youtu.be/le60NzmxU6s Video]<br />
|-<br />
| 15h30 - 16h00<br />
| style="text-align: center;background: grey; color: white" colspan="3" | ''Afternoon Break'' <br />
|-<br />
| 16h00 - 16h45<br />
| [[#TALK_1600 | Jeroen Willemsen]]<br />
| [[#TALK_1600 | Fast forwarding Mobile Security with the MSTG]]<br />
| [[Media:OWASP BeNeLux 2018 Jeroen Willemsen - Fast forwarding Mobile Security with the MSTG compressed.pdf | Slides ]]<br><br />
[https://youtu.be/WI2_cP48TnA Video]<br />
|-<br />
| 16h45 - 17h30<br />
| [[#TALK_1645 | Nick Drage]]<br />
| [[#TALK_1645 | Lessons from the legion (The OWASP BeNeLux Remix)]]<br />
| [[Media:OWASP BeNeLux 2018 Nick Drage - Lessons from the Legion compressed.pdf | Slides]]<br><br />
[https://youtu.be/516Z420BgkE Video]<br />
|-<br />
| 17h30 - 17h45<br />
| style="text-align: center;background: grey; color: white" colspan="3" | ''Closing'' <br />
|}<br />
<br />
== Talks == <br />
<br />
=== <span id="TALK_0930">Fast, Furious and Insecure: Passive Keyless Entry and Start in Modern Supercars by Lennert Wouters</span> ===<br />
<br />
==== Abstract ====<br />
<br />
The security of immobiliser and Remote Keyless Entry systems has been extensively studied over the past years. Passive Keyless Entry and Start systems, which are currently deployed in luxury vehicles, have not received as much attention.<br />
During this presentation we will share the techniques used in reverse engineering the Tesla Model S Passive Keyless Entry and Start system. We will discuss multiple security weaknesses in the system including the use of an inadequate proprietary cipher using 40-bit keys, the lack of mutual authentication in the challenge-response protocol, hardware configuration mistakes and the absence of security partitioning.<br><br />
We verified our findings by implementing a proof of concept attack allowing us to clone a Tesla Model S key fob in a matter of seconds with low cost commercial off the shelf equipment.<br><br />
Finally, we will share our experience with the responsible disclosure of these finding to Tesla Motors and other likely affected manufacturers such as McLaren, Karma Automotive and Triumph Motorcycles as they all use the same system developed by Pektron.<br />
<br />
====Bio====<br />
<br />
Lennert Wouters is a PhD researcher at the Computer Security and Industrial Cryptography (COSIC) research group at KU Leuven. His research interests involve hardware security of connected embedded devices and side channel attacks.<br />
<br />
=== <span id="TALK_1015">Weaknesses in our voice communications network: from Blue Boxing to VoLTE by Ralph Moonen</span> ===<br />
<br />
==== Abstract ====<br />
<br />
Voice over 4G, or VoLTE, brings back the phreaking 80's. Once again, after 3 decades, the signaling path of telephony is accessible to end users. No more R1, R2, C4 or C5 however: we now have SIP. As it turns out, the implementations of SIP and VoLTE in various European providers' 4G infrastructures, open up a host of possibilities. During our research over the past few years we have identified vulnerabilities in implementations such as txt message spoofing, subscriber enumeration, location determination (leakage of cell-ID and LAC), IMEI leakage and a potential SIM-card sharing attack.<br><br />
During this talk we will begin with a little historic stroll of phone phreaking through notable events and discoveries over the years. Bridging the narrative over the last few decades, new technologies such as VoIP, Volte, and VoWiFi are introduced, explaining the 4G and VoLTE infrastructure components and protocols. Next, on a rooted Android phone, we will show what control the user has over the VoLTE stack using some standard tools and the IPv6 stack. This includes hidden activities in Android and extraction of IPsec keys from the VoLTE stack. We will show that it is possible to import keys to Wireshark and monitor the IPv6 SIP traffic and components. Finally, examples of the vulnerabilities in implementations such as txt message spoofing, subscriber enumeration, location determination (leakage of cell-ID and LAC), IMEI leakage and a potential SIM-card sharing attack will be explained.<br><br />
Yes, a slightly technical nugget of knowledge, yet very accessible and a lot of fun!<br><br />
<br><br />
'''Importance of presentation for involved audience'''<br><br />
The phone systems of the world have always been of interest to everyone: from users who expect privacy, to intelligence agencies who want access. The privacy, integrity and confidentiality of voice communications over telecommunication networks is therefore of interest to anyone who uses mobile phones (i.e.: everyone). It is also typically a closed subject with very little research being done, relative to other security topics such as malware and application vulnerabilities. The combination of little research and high impact on everyone, makes that this topic deserves much more attention than it currently does. The VoLTE weaknesses we will describe are implementation dependent, and largely unpublished (i.e. new).<br />
<br />
==== Bio ====<br />
<br />
Ralph Moonen CISSP is Technical Director at Secura. Ralph is an old-school ethical hacker with 3 decades of experience as penetration tester, IT-auditor and security consultant. Now, as Technical Director, he is responsible for topics such as R&D and technical projects at Secura.<br />
<br />
=== <span id="TALK_1130">When Serverless Met Security… Serverless Security & Functions-as-a-Service (FaaS) by Niels Tanis</span> ===<br />
<br />
==== Abstract ====<br />
<br />
Serverless is a design pattern for writing scalable applications in which Functions as a Service (FaaS) is one of the key building blocks. Every mayor Cloud Provider has got his own FaaS available. On Microsoft Azure there is Azure Functions, AWS has got Lambda and Cloud Functions can be used on the Google Cloud. All of these have a lot of similarities in the way they allow developers to create small event driven services. <br><br />
From security perspective there are a lot of benefits when moving to a serverless architecture. There is no need to manage any of the machines and the underlying infrastructure. Dealing with updates, patches and infrastructure is the responsibility of the platform provider. FaaS are short lived processes which will be instantiated and destroyed in a matter of milliseconds making it more resilient to denial-of-services (DoS) and also makes it harder to attack and compromise. <br><br />
But will all of this be sufficient to be ’secure’ or should we be worried about more? With serverless there is still a piece of software that will be developed, build, deployed and executed. It will also introduce a more complex architecture with corresponding attack surface which also makes it hard to monitor. What about the software supply chain and delivery pipeline? There still will be a need to patch your software for vulnerabilities in code and used 3rd party libraries. In this talk we will identify the security area’s we do need to focus on when developing serverless and define possible solutions for dealing with those problems.<br />
<br />
==== Bio ====<br />
<br />
Niels Tanis has got a background in .NET development, pentesting and security consultancy. He also holds the CSSLP certification and has been involved in breaking, defending and building secure applications. He joined Veracode in 2015 and right now he works as a security researcher on a variant of languages and technologies related to Veracode’s Binary Static Analysis service. He is married, father of 2 and lives in a small village just outside Amersfoort, The Netherlands.<br />
<br />
<br />
=== <span id="TALK_1215">OWASP Zap by David Scrobonia</span> ===<br />
<br />
==== Abstract ====<br />
<br />
Intoducing security testing tools to a QA or developers workflow can be difficult when the tools aren't easy or intuitive to use. Even for security professionals, the friction of cumbersome security tooling can prevent them from getting the most from a tool or being effective with their time.<br><br />
The OWASP ZAP team is working to help enable developers, QA, and hackers alike with the ZAP Heads Up Display, a more user friendly way to engage with the security testing tool. The Heads Up Displays integrates ZAP directly in the browser providing all of the funcitonality of the tool via a heads up display. The goal is to make ZAP more accessible and enabling users, especially developers, to integrate security in their daily workflows.<br><br />
This talk will discuss the importance of usable tools, design tradeoffs made to improve usability, the various browser technologies powering the HUD, and how you can start hacking with a heads up display.<br />
<br />
==== Bio ====<br />
<br />
David Scrobonia is a part of the Security Engineering team at Segment working to secure modern web apps and AWS infrastructure. He contributes to open source in his spare time and is a core team member of the OWASP ZAP project.<br />
<br />
<br />
=== <span id="TALK_1400">Juice Shop: OWASP's most broken Flagship by Björn Kimminich</span> ===<br />
<br />
==== Abstract ====<br />
<br />
OWASP Juice Shop is an intentionally insecure webapp for security trainings written entirely in Javascript which encompasses the entire OWASP Top Ten and many more severe security flaws. In this talk, you'll learn about this open-source project and its capabilities first-hand from its creator. Join a “happy shopper round trip,” enjoy a hacking demo of some of the built-in challenges, witness how to re-theme the Juice Shop into a security awareness booster for your own company, and learn how to set it up for a capture-the-flag (CTF) event in less than 5 minutes!<br />
<br />
====Bio====<br />
<br />
Björn Kimminich is responsible for global IT architecture and application security at Kuehne + Nagel. On the side, he gives IT security lectures at the non-profit private university Nordakademie. Björn also is the project leader of the OWASP Juice Shop and a board member for the German OWASP chapter. <br><br />
[[File:GitHub-Mark_no_background.png|25px|link=https://github.com/bkimminich|GitHub]]<br />
[[File:TwitterLogo.png|25px|link=http://twitter.com/bkimminich|Twitter]]<br />
[[File:LinkedinSquareLogo.png|25px|link=https://www.linkedin.com/in/bkimminich|LinkedIn]]<br />
<br />
<br />
=== <span id="TALK_1445">Leaky Processors: Stealing Your Secrets with Foreshadow by Jo Van Bulck</span> ===<br />
<br />
==== Abstract ====<br />
<br />
For decades, memory isolation has been one of the key principles of<br />
secure system design. The recent wave of speculative execution attacks,<br />
including Meltdown, Spectre, and Foreshadow abruptly showed, however,<br />
that performance optimizations in modern processors fundamentally<br />
undermine application security.<br><br />
This talk will review how speculative execution attacks work. What makes<br />
them dangerous, and why they require a paradigm shift in the way we<br />
think about application security. The talk will have a special focus on<br />
the recently disclosed Foreshadow CPU vulnerability, which led to a<br />
complete collapse of state-of-the-art Intel SGX technology, and<br />
necessitated hardware and software patches for all major operating<br />
systems and virtual machine hypervisors.<br />
<br />
==== Bio ====<br />
<br />
Jo Van Bulck is a PhD researcher at imec-DistriNet, KU Leuven, where he<br />
investigates hardware-level trusted computing from an integrated attack<br />
and defense perspective. His work resulted in a.o., the high-impact<br />
Foreshadow CPU vulnerability announced in August 2018, and several<br />
open-source secure processor prototypes.<br />
<br />
<br />
=== <span id="TALK_1600">Fast forwarding Mobile Security with the MSTG by Jeroen Willemsen</span> ===<br />
<br />
==== Abstract ====<br />
<br />
After the startup of the mobile security project in 2010, the mobile security project and its testing guides have seen quiet some evolution. All of this changed quiet intensively when, in 2016, the Mobile Application Security Verification Standard (MASVS) and the Mobile Application Security Testing Guide (MSTG) were created. Now, two years fast forward: where are we now? How can you use it as a pentester or a developer? We will start with introducing the current state of the MSTG and its side-projects and then show various demos on iOS.<br><br />
<br />
==== Bio ====<br />
<br />
Jeroen Willemsen is a Principal Security Architect at Xebia. With a love for mobile security, he recently became one of the projectleaders for the OMTG project (MASVS & MSTG). Jeroen is more or less a jack of all trades with interest in infrastructure security, risk management and application security.<br />
<br />
=== <span id="TALK_1645">Lessons From The Legion (The OWASP BeNeLux Remix) by Nick Drage</span> ===<br />
<br />
==== Abstract ====<br />
<br />
Look at your job, your colleagues, your industry. Very smart people, working very hard... and yet it feels like we're losing.<br><br />
<br><br />
''Why?''<br><br />
<br><br />
Cyber security has always been a technology driven, engineer led industry - self-taught practitioners have chosen tactics and point solutions based on what fits in with their preferred ways of working and studying. We need better strategies to make use of those tactics. We can learn those strategies from other contexts and conflicts to improve our own methods and practices.<br><br />
<br><br />
''Would you like to start winning?''<br />
====Bio====<br />
<br />
Nick is the Director of Path Dependence Limited, and has over two decades of experience in the cyber security field… previously he was "SecOps” before the term was invented, as well as having been a SysAdmin, PCI QSA, pre-sales analyst, CHECK Team Leader, and various other less well defined roles. Nick is currently a Cyber Security Consultant and Penetration Tester, with occasional forays into being a Wargame Umpire, Adversarial Analyst, or Professional Wildcard.<br />
<br />
=== <span id="CyberWayFinder">Women in cybersecurity (CyberWayFinder)</span> ===<br />
OWASP BeNeLux and CyberWayFinder would like to invite you to a '''breakfast with other women in cybersecurity'''.<br><br />
Since women make up 7% of the cybersecurity work force, they are a rare breed, and don't often meet each other. That is why "women in cybersecurity breakfasts" are popping up in conferences around the world.<br />
A small gathering with the women who will be present at our OWASP conference in the morning provides an excellent network opportunity to meet one another. We'll make sure you don't start out the day on an empty stomach, and provide you with some contacts, without missing out on the rest of the conference.<br><br />
join us as of 08h30 at Lamot conference center, and also hear about the CyberWayFinder training program which is being created to help women transition their career into cybersecurity.<br><br />
<br />
<!-- Sixth tab --><br />
<br />
= Social Event =<br />
<br />
'''The Social Event is on Thursday, November 29th'''<br />
<br />
The social event will be a unique opportunity to meet some of the trainers and speakers, as well the organisers or even peers.<br><br><br />
<br />
The social event will take place in restaurant [http://www.puro-mechelen.be/english Puro Mechelen], a couple of minutes from the conference center, on Thursday 29/11 at 19h00.<br><br><br />
There is a fixed group menu (meat or fish) for '''59€/person''', drinks included.<br><br><br />
Link to the [https://static1.squarespace.com/static/53bedc63e4b051fad94ee1f7/t/59b7d81ea803bbc8f65d85ee/1505220639318/Puro-groepsmenu.pdf Menus] (page 1), and the [https://static1.squarespace.com/static/53bedc63e4b051fad94ee1f7/t/54b57100e4b0ab0673e80e8d/1421177088856/drankenformules.doc.pdf drinks].<br />
<br><br />
<br />
'''Any participant pays individually. <br>Reservation via the form you'll receive after conference registration is mandatory.'''<br><br />
<br />
<br />
<!--<br />
Address: TBD<br />
<br />
Menu:TBD<br />
--><br />
<!-- Seventh tab --><br />
= Sponsor =<br />
<br />
''' Become a sponsor of OWASP BeNeLux! '''<br />
<br />
There are 3 combined sponsorship packages (Gold, Silver or Bronze) that cover the BeNeLux chapter meetings 2019 and the BeNeLux OWASP Days 2018.<br />
<br />
Download our [https://www.owasp.org/images/8/8e/OWASP_BeNeLux_2018_Sponsorship_Form_v20181004.pdf sponsor brochure] and contact [mailto:seba@owasp.org us] for questions or sponsorship confirmation!<br />
<br />
Your sponsorship will be invested directly in the chapter meetings, supporting speaker and catering expenses. <br />
<br />
The sponsorship will also be dedicated to cover the costs of the OWASP 2018 BeNeLux event.<br />
<br />
<!-- Don't remove these two lines! -->__NOTOC__ <br />
<headertabs></headertabs><br />
<br />
=== Made possible by our {{#switchtablink:Sponsor|Sponsors}}===<br />
<br />
==== Gold ====<br />
<br />
[[File:DavinsiLabs.png|250px|link=https://www.davinsilabs.com]]<br />
[[File:Vest.jpg|250px|link=http://www.vest.nl]]<br />
<br />
<br />
==== Silver ====<br />
<br />
[[File:LogoIngenicoGroup.png|250px|link=https://ingenico.be]]<br />
[[File:LogoToreon.jpg|250px|link=https://www.toreon.com]] <br />
[[File:LogoSynopsys.png|250px|link=https://www.synopsys.com]]<br />
[[File:Nviso_logo_RGB_baseline_200px.png|250px|link=http://www.nviso.be]] <br />
<br />
<br />
<br />
==== Bronze ====<br />
<br />
[[File:Logo_Informatiebeveiliging-200.png|250px|link=https://informatiebeveiliging.nl/]]<br />
<br />
[[Category:OWASP_AppSec_Conference]] <br />
[[Category:OWASP_BeNeLux_Archives]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&diff=251306OWASP SAMM Project2019-05-10T06:42:38Z<p>Sdeleersnyder: </p>
<hr />
<div>= Main = <br />
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''Join us at the Open Security Summit next June'''<br><br />
We have a dedicated [https://opensecuritysummit.org/tracks/owasp-samm/ SAMM track] at the upcoming Open Security Summit (supported by OWASP)!<br><br />
You can register for on-site or remote participation [https://opensecuritysummit.org/tickets/ here].<br><br />
<br />
'''OWASP SAMMv2 beta released for community review'''<br><br />
We are very proud to announce a new version of SAMM!<br><br />
Check it out on our new website: https://owaspsamm.org/.<br><br />
Please, read our notes on how to provide [https://owaspsamm.org/v2.0b/feedback/ feedback].<br />
<br />
'''OWASP SAMM v1.5 available in the downloads section!'''<br><br />
We are now working on the Beta release of OWASP SAMMv2, our work in progress is available [https://owaspsamm.org online on our new web site]. <br><br />
<br />
'''Join our monthly calls'''<br />
* The monthly call is on each 2nd Wednesday of the month at 21h30 CEST / 3:30pm EST. <br><br />
* Please join our GoToMeeting: https://global.gotomeeting.com/join/262891661 <br><br />
* The call is open for everybody interested in SAMM or who wants to work on SAMM. <br><br />
<br />
'''Join us on the OWASP SAMM project Slack channel'''<br />
* Join our project slack channel on https://owasp.slack.com/messages/C0VF1EJGH <br />
* If you do not have an OWASP Slack workspace account yet, contact one of our project leaders to get an invite link.<br />
<br />
'''2019 OWASP SAMM Summit (3-7 JUNE 2019, Bedford, UK)'''<br />
* Join our 2019 OWASP SAMM Summit at Woburn Forest, Bedfordshire as part of the [https://open-security-summit.org/ Open Security Summit].<br />
* We will organize working sessions in a 5-day sprint to draft SAMM v2.0. <br />
* Register online [https://open-security-summit.org/tickets/ here]<br />
* Sponsor the SAMM2, more details [https://www.owasp.org/index.php/OWASP_SAMM_Project#tab=Project_Sponsors here]<br />
<br />
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:<br />
* '''Evaluate an organization’s existing software security practices'''<br />
* '''Build a balanced software security assurance program in well-defined iterations'''<br />
* '''Demonstrate concrete improvements to a security assurance program'''<br />
* '''Define and measure security-related activities throughout an organization'''<br />
<br />
<br />
<br />
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'', ('''Michael J. Craigue, Information Security & Compliance, Dell, Inc.''')<br />
<br />
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]<br />
<br />
{{Social Media Links}}<br />
<br />
| valign="top" style="padding-left:25px;width:200px;" |<br />
<br />
== Quick Download v1.5 ==<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Toolbox Example] <br><br />
[https://github.com/OWASP/samm/ OWASP SAMM on GitHub]<br />
<br />
== Quick Download v1.1.1 ==<br />
<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]<br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box]<br><br />
[https://github.com/OWASP/samm OWASP SAMM on GitHub]<br />
<br />
== News and Events ==<br />
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs<br />
<br />
== Change Log ==<br />
* OWASP SAMM v1.5 Released! ([http://www.prnewswire.com/news-releases/owasp-samm-v15-helps-organizations-improve-their-security-posture-300439237.html Press Release])<br />
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
== Email List ==<br />
<br />
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]<br />
<br />
== Project Leaders ==<br />
<br />
[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] <br /> [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win]<br />
<br />
== Related Projects ==<br />
<br />
*<br />
<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]<br />
| align="center" valign="center" width="50%" | [[File:Owasp-defenders-small.png|link=]]<br />
|<br />
|-<br />
| align="center" valign="center" width="50%" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= Browse Online =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.<br />
<br />
[[Image:SAMM-Overview.png|720px]]<br />
<br />
===== Click on any badge to learn more =====<br />
<br />
{| cellpadding="1"<br />
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]<br />
|-<br />
| align="center" |'''Strategy & Metrics'''<br />
|{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM|padding=0}}<br />
|-<br />
| align="center" |'''Policy & Compliance'''<br />
|{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC|padding=0}}<br />
|-<br />
| align="center" |'''Education & Guidance'''<br />
|{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]<br />
|-<br />
| align="center" |'''Threat Assessment'''<br />
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}<br />
|-<br />
| align="center" |'''Security Requirements'''<br />
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}<br />
|-<br />
| align="center" |'''Secure Architecture'''<br />
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]<br />
|-<br />
| align="center" |'''Design Review'''<br />
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}<br />
|-<br />
| align="center" |'''Code Review'''<br />
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}<br />
|-<br />
| align="center" |'''Security Testing'''<br />
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]<br />
|-<br />
| align="center" |'''Vulnerability Management'''<br />
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}<br />
|-<br />
| align="center" |'''Environment Hardening'''<br />
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}<br />
|-<br />
| align="center" |'''Operational Enablement'''<br />
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}<br />
|-<br />
|}<br />
<br />
= Downloads =<br />
<br />
The latest work in progress can be found on Github: https://github.com/OWASP/samm<br />
<br />
Download SAMM v1.5<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] Zip file containing all the v1.5 files below;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] to perform SAMM assessments and create SAMM roadmaps;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Tool Box Example] to provide an example SAMM assessment;<br />
<br />
Download SAMM v1.1<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;<br />
<br />
Download OpenSAMM v1.0:<br />
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML<br />
* in [https://www.owasp.org/images/f/fd/SAMM-1.0-cn.pdf Chinese - PDF], not available as XML<br />
<br />
<br />
Available resources to apply SAMM:<br />
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]<br />
<br />
<br />
Trainings:<br />
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge<br />
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]<br />
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]<br />
<br />
<br />
Assessments:<br />
* SAMM v1.5 Toolbox<br />
** Download the new v1.5 Toolbox with the updated scoring model [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM v1.5 Toolbox]<br />
* SAMM v1.1 Toolbox<br />
** download the v1.1 toolbox, including the updated questions [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx here]<br />
* Assessment Interview Template by Nick Coblentz for SAMM V1.0<br />
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.<br />
* Roadmap Chart Template by Colin Watson for SAMM V1.0<br />
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.<br />
* Assessment Worksheet by Christian Frichot for SAMM V1.0<br />
** This is an easy-to-use [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.<br />
* Project Plan Template by Jim Weiler for SAMM V1.0<br />
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.<br />
<br />
<br />
Mappings:<br />
* BSIMM-6 mapping to SAMM activities:<br />
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]<br />
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]<br />
* BSIMM mapping to SAMM during the 2011 Summit:<br />
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).<br />
<br />
<br />
Tools:<br />
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]<br />
<br />
= Community =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}<br />
<br />
</div><br />
<br />
= Summit =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
'''Join us at the Open Security Summit next June'''<br><br />
We have a dedicated [https://opensecuritysummit.org/tracks/owasp-samm/ SAMM track] at the upcoming Open Security Summit (supported by OWASP)!<br><br />
You can register for on-site or remote participation [https://opensecuritysummit.org/tickets/ here].<br><br />
<br />
We organised a core team summit in November 2018 in Minneapolis, check out the results [https://github.com/OWASP/samm/blob/master/Supporting%20Resources/v2.0/summit-201810-Minneapolis/Summit-outcomes.md here].<br />
<br />
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 >here<] !!<br />
<br />
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit<br />
<br />
<br />
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 >here<] !!<br />
<br />
Summit Notes:<br />
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit<br />
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]<br />
''"The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers."'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company<br />
<br />
Previous workshop Notes:<br />
<br />
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.<br />
<br />
This is also an excellent opportunity to exchange experiences with your peers.<br />
<br />
If you plan on attending http://appsec.eu be sure to get involved in the SAMM workshop (scheduled on Jun-23).<br />
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].<br />
<br />
Previous workshop notes:<br />
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].<br />
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].<br />
<br />
<br />
= Talks =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
Upcoming talks featuring SAMM are listed here:<br />
<br />
* OWASP DC - Software Assurance Maturity Model (SAMM) with Brian Glas! (2017-03-15)<br />
* OWASP NoVA - SAMM 1.5, what's changed and how it impacts you (2017-03-16)<br />
* InfoSec World - Software Assurance Maturity Model Evolutions (2017-04-03)<br />
<br />
past talks:<br />
<br />
* OWASP SAMM v1.5 Webinar - Brian Glas discussing the SAMM model and changes in v1.5 (watch - [https://www.youtube.com/watch?v=4pKdwRb8fTI youtube]) - 2017<br />
* OWASP 24/7 - Seba Deleersnyder discussing the upcoming SAMM Summit (listen - [https://soundcloud.com/owasp-podcast/seba-deleersnyder-discusses-samm-software-assurance-maturity-model-summit-in-dublin-ireland here]) - 2015<br />
* OWASP Germany Day 2014: Seba Deleersnyder: OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/f/fa/OpenSAMM_Best_Practices_Lessons_from_the_Trenches_-_Seba_Deleersnyder.pdf presentation]) - 2014<br />
* AppSecEU14: Seba Deleersnyder & Bart De Win: OpenSAMM Best Practices: Lessons from the Trenches OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/6/6f/OpenSAMM_-_AppSecEU_2014_-_Seba-Bart_v20140528.pptx presentation], see [https://www.youtube.com/watch?v=qcCgeBeBLUg video]) - 2014<br />
* AppSecEU13 - Hamburg: Seba Deleersnyder presenting a project update (download [https://www.owasp.org/images/3/32/OpenSAMM_-_Project_Status_-_Hamburg_2013.pdf presentation]) - 2013<br />
* OWASP Europe Tour 2013 - Geneva: Seba Deleersnyder presenting OpenSAMM and the renewed project (download [https://www.owasp.org/images/c/cd/OpenSAMM_-_OWASP_Tour_13_Talk_-_Seba.pptx presentation]) - 2013<br />
* AppSecEU11 - Athens: Colin Watson presenting SAMM Training (download [https://www.owasp.org/images/1/18/Owasp-training-samm-greece.pdf presentation]) - 2011<br />
* AppSecEU09: Pravir Chandra presenting OpenSAMM v1.0 (download [https://www.owasp.org/images/4/49/AppSecEU09_OpenSAMM-1.0.ppt presentation]) - 2009<br />
* Matt Bartoldus presentation on new SAMM project during OWASP London chapter (download [https://www.owasp.org/images/d/df/OpenSAMM.pdf presentation]) - 2009<br />
* Pravir Chandra - first presentation discussing the next generation to the CLASP Project- a complete working of the details into a Software Assurance Maturity Model (SAMM). (download [https://www.owasp.org/images/2/2e/OWASP_CLASP_SAMM.ppt presentation]) - 2009<br />
<br />
</div><br />
<br />
= News =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Latest News on SAMM<br />
* OWASP SAMM v2.0 workshop at the OWASP Project Summit June 2017<br />
* OWASP SAMM v1.5 Released!<br />
* SAMM Summit 2016 read the [https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit wrap-up here] <br />
* OWASP SAMM v1.1 Released! See the [http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release].<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
</div><br />
<br />
= Languages =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''SAMM v1.0 is available in the following languages:'''<br />
<br />
* English<br />
* Spanish<br />
* Japanese<br />
* Chinese<br />
<br />
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].<br />
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!<br />
<br />
</div><br />
<br />
= Roadmap =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Updated roadmap:<br />
Next 1.5 release, updated scoring:<br />
* Clarification of maturity levels (syntactic changes to keep the text consistent)<br />
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. <br />
* Show improvements with every activity introduced<br />
* Adapt for the new scoring method<br />
* Update questions for 4-tiers<br />
* Review and where necessary clarify current questions<br />
* Consider v1.1 remarks that were not withheld for the previous release<br />
Targeted completion date: February 28, 2017<br />
<br />
SAMM version 2.0<br />
* Core model changed<br />
* Visualisations + flavours for a few development methodologies<br />
* Update quickstart guide, TB, HTG. <br />
* Success metrics: How well does the model work: Linked to the benchmarking project.<br />
Timing: Workshops as part of OWASP Project Summit June 2017<br />
<br />
</div><br />
= Get Involved =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Involvement in the development of SAMM is actively encouraged!<br />
<br />
You do not have to be a security expert in order to contribute.<br />
<br />
Some of the ways you can help:<br />
<br />
==Feedback==<br />
<br />
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:<br />
* What do like?<br />
* What don't you like?<br />
* How can we make SAMM easier to use?<br />
* How could SAMM be improved? <br />
<br />
<br />
==Localization==<br />
<br />
Are you fluent in another language? Can you help translate SAMM into that language?<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!<br />
<br />
</div><br />
<br />
= Project Sponsors =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
SAMM is developed and maintained by a worldwide team of volunteers. We have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM.<br />
<br />
==SAMM Adopters==<br />
SAMM is the premier open source software assurance framework. You can find a list of [https://www.owasp.org/index.php/OpenSAMM_Adopters SAMM adopters] online.<br />
<br />
==Call for SAMM2 Sponsors==<br />
OWASP SAMM and the upcoming SAMM 2.0 release is the open source software security maturity model used to develop secure software for IT, application and software security technologists. <br />
<br />
We are seeking sponsors to support OWASP SAMM. All proceeds from the sponsorship support the mission of the OWASP Foundation and the further development of SAMM. Supporting the project drives the funding for research grants, SAMM hosting, tools, templates, documents, promotion, and more.<br />
<br />
By sponsoring SAMM, you not only support an important and flagship OWASP project, you will also get visibility during the next SAMM Summit (part of the [https://open-security-summit.org/ Open Security Summit 2019]) and recognition on the OWASP SAMM [https://owaspsamm.org/ web site] and the next release of SAMM (version 2.0).<br />
<br />
For more information: Contact [mailto:seba@owasp.org seba@owasp.org]<br />
<br />
==== Acknowledgements ====<br />
<br />
We would like to thank the following sponsors who donated funds to our project:<br />
<br />
[[File:Imageedit_15_5335623074.png|frameless]][[File:Fortify blue 800px.png|250px|link=https://www.microfocus.com/en-us/solutions/application-security]][[File:1280px-NCC Group logo.svg.png|frameless]][[File:Splunk copy.png|frameless]] <br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
<br /><br />
{{OWASP Book|6888083}}<br />
<br /><br />
<br />
[[Category:OWASP Project|Zed Attack Proxy Project]]<br />
[[Category:OWASP_Tool]]<br />
[[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]]<br />
[[Category:OWASP_Download]]<br />
[[Category:Popular]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:Splunk_copy.png&diff=251305File:Splunk copy.png2019-05-10T06:42:11Z<p>Sdeleersnyder: </p>
<hr />
<div>logo</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:1280px-NCC_Group_logo.svg.png&diff=251304File:1280px-NCC Group logo.svg.png2019-05-10T06:38:29Z<p>Sdeleersnyder: </p>
<hr />
<div>logo</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&diff=251303OWASP SAMM Project2019-05-10T06:35:32Z<p>Sdeleersnyder: /* Summit */</p>
<hr />
<div>= Main = <br />
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''Join us at the Open Security Summit next June'''<br><br />
We have a dedicated [https://opensecuritysummit.org/tracks/owasp-samm/ SAMM track] at the upcoming Open Security Summit (supported by OWASP)!<br><br />
You can register for on-site or remote participation [https://opensecuritysummit.org/tickets/ here].<br><br />
<br />
'''OWASP SAMMv2 beta released for community review'''<br><br />
We are very proud to announce a new version of SAMM!<br><br />
Check it out on our new website: https://owaspsamm.org/.<br><br />
Please, read our notes on how to provide [https://owaspsamm.org/v2.0b/feedback/ feedback].<br />
<br />
'''OWASP SAMM v1.5 available in the downloads section!'''<br><br />
We are now working on the Beta release of OWASP SAMMv2, our work in progress is available [https://owaspsamm.org online on our new web site]. <br><br />
<br />
'''Join our monthly calls'''<br />
* The monthly call is on each 2nd Wednesday of the month at 21h30 CEST / 3:30pm EST. <br><br />
* Please join our GoToMeeting: https://global.gotomeeting.com/join/262891661 <br><br />
* The call is open for everybody interested in SAMM or who wants to work on SAMM. <br><br />
<br />
'''Join us on the OWASP SAMM project Slack channel'''<br />
* Join our project slack channel on https://owasp.slack.com/messages/C0VF1EJGH <br />
* If you do not have an OWASP Slack workspace account yet, contact one of our project leaders to get an invite link.<br />
<br />
'''2019 OWASP SAMM Summit (3-7 JUNE 2019, Bedford, UK)'''<br />
* Join our 2019 OWASP SAMM Summit at Woburn Forest, Bedfordshire as part of the [https://open-security-summit.org/ Open Security Summit].<br />
* We will organize working sessions in a 5-day sprint to draft SAMM v2.0. <br />
* Register online [https://open-security-summit.org/tickets/ here]<br />
* Sponsor the SAMM2, more details [https://www.owasp.org/index.php/OWASP_SAMM_Project#tab=Project_Sponsors here]<br />
<br />
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:<br />
* '''Evaluate an organization’s existing software security practices'''<br />
* '''Build a balanced software security assurance program in well-defined iterations'''<br />
* '''Demonstrate concrete improvements to a security assurance program'''<br />
* '''Define and measure security-related activities throughout an organization'''<br />
<br />
<br />
<br />
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'', ('''Michael J. Craigue, Information Security & Compliance, Dell, Inc.''')<br />
<br />
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]<br />
<br />
{{Social Media Links}}<br />
<br />
| valign="top" style="padding-left:25px;width:200px;" |<br />
<br />
== Quick Download v1.5 ==<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Toolbox Example] <br><br />
[https://github.com/OWASP/samm/ OWASP SAMM on GitHub]<br />
<br />
== Quick Download v1.1.1 ==<br />
<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]<br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box]<br><br />
[https://github.com/OWASP/samm OWASP SAMM on GitHub]<br />
<br />
== News and Events ==<br />
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs<br />
<br />
== Change Log ==<br />
* OWASP SAMM v1.5 Released! ([http://www.prnewswire.com/news-releases/owasp-samm-v15-helps-organizations-improve-their-security-posture-300439237.html Press Release])<br />
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
== Email List ==<br />
<br />
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]<br />
<br />
== Project Leaders ==<br />
<br />
[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] <br /> [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win]<br />
<br />
== Related Projects ==<br />
<br />
*<br />
<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]<br />
| align="center" valign="center" width="50%" | [[File:Owasp-defenders-small.png|link=]]<br />
|<br />
|-<br />
| align="center" valign="center" width="50%" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= Browse Online =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.<br />
<br />
[[Image:SAMM-Overview.png|720px]]<br />
<br />
===== Click on any badge to learn more =====<br />
<br />
{| cellpadding="1"<br />
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]<br />
|-<br />
| align="center" |'''Strategy & Metrics'''<br />
|{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM|padding=0}}<br />
|-<br />
| align="center" |'''Policy & Compliance'''<br />
|{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC|padding=0}}<br />
|-<br />
| align="center" |'''Education & Guidance'''<br />
|{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]<br />
|-<br />
| align="center" |'''Threat Assessment'''<br />
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}<br />
|-<br />
| align="center" |'''Security Requirements'''<br />
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}<br />
|-<br />
| align="center" |'''Secure Architecture'''<br />
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]<br />
|-<br />
| align="center" |'''Design Review'''<br />
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}<br />
|-<br />
| align="center" |'''Code Review'''<br />
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}<br />
|-<br />
| align="center" |'''Security Testing'''<br />
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]<br />
|-<br />
| align="center" |'''Vulnerability Management'''<br />
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}<br />
|-<br />
| align="center" |'''Environment Hardening'''<br />
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}<br />
|-<br />
| align="center" |'''Operational Enablement'''<br />
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}<br />
|-<br />
|}<br />
<br />
= Downloads =<br />
<br />
The latest work in progress can be found on Github: https://github.com/OWASP/samm<br />
<br />
Download SAMM v1.5<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] Zip file containing all the v1.5 files below;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] to perform SAMM assessments and create SAMM roadmaps;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Tool Box Example] to provide an example SAMM assessment;<br />
<br />
Download SAMM v1.1<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;<br />
<br />
Download OpenSAMM v1.0:<br />
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML<br />
* in [https://www.owasp.org/images/f/fd/SAMM-1.0-cn.pdf Chinese - PDF], not available as XML<br />
<br />
<br />
Available resources to apply SAMM:<br />
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]<br />
<br />
<br />
Trainings:<br />
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge<br />
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]<br />
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]<br />
<br />
<br />
Assessments:<br />
* SAMM v1.5 Toolbox<br />
** Download the new v1.5 Toolbox with the updated scoring model [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM v1.5 Toolbox]<br />
* SAMM v1.1 Toolbox<br />
** download the v1.1 toolbox, including the updated questions [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx here]<br />
* Assessment Interview Template by Nick Coblentz for SAMM V1.0<br />
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.<br />
* Roadmap Chart Template by Colin Watson for SAMM V1.0<br />
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.<br />
* Assessment Worksheet by Christian Frichot for SAMM V1.0<br />
** This is an easy-to-use [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.<br />
* Project Plan Template by Jim Weiler for SAMM V1.0<br />
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.<br />
<br />
<br />
Mappings:<br />
* BSIMM-6 mapping to SAMM activities:<br />
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]<br />
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]<br />
* BSIMM mapping to SAMM during the 2011 Summit:<br />
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).<br />
<br />
<br />
Tools:<br />
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]<br />
<br />
= Community =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}<br />
<br />
</div><br />
<br />
= Summit =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
'''Join us at the Open Security Summit next June'''<br><br />
We have a dedicated [https://opensecuritysummit.org/tracks/owasp-samm/ SAMM track] at the upcoming Open Security Summit (supported by OWASP)!<br><br />
You can register for on-site or remote participation [https://opensecuritysummit.org/tickets/ here].<br><br />
<br />
We organised a core team summit in November 2018 in Minneapolis, check out the results [https://github.com/OWASP/samm/blob/master/Supporting%20Resources/v2.0/summit-201810-Minneapolis/Summit-outcomes.md here].<br />
<br />
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 >here<] !!<br />
<br />
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit<br />
<br />
<br />
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 >here<] !!<br />
<br />
Summit Notes:<br />
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit<br />
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]<br />
''"The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers."'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company<br />
<br />
Previous workshop Notes:<br />
<br />
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.<br />
<br />
This is also an excellent opportunity to exchange experiences with your peers.<br />
<br />
If you plan on attending http://appsec.eu be sure to get involved in the SAMM workshop (scheduled on Jun-23).<br />
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].<br />
<br />
Previous workshop notes:<br />
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].<br />
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].<br />
<br />
<br />
= Talks =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
Upcoming talks featuring SAMM are listed here:<br />
<br />
* OWASP DC - Software Assurance Maturity Model (SAMM) with Brian Glas! (2017-03-15)<br />
* OWASP NoVA - SAMM 1.5, what's changed and how it impacts you (2017-03-16)<br />
* InfoSec World - Software Assurance Maturity Model Evolutions (2017-04-03)<br />
<br />
past talks:<br />
<br />
* OWASP SAMM v1.5 Webinar - Brian Glas discussing the SAMM model and changes in v1.5 (watch - [https://www.youtube.com/watch?v=4pKdwRb8fTI youtube]) - 2017<br />
* OWASP 24/7 - Seba Deleersnyder discussing the upcoming SAMM Summit (listen - [https://soundcloud.com/owasp-podcast/seba-deleersnyder-discusses-samm-software-assurance-maturity-model-summit-in-dublin-ireland here]) - 2015<br />
* OWASP Germany Day 2014: Seba Deleersnyder: OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/f/fa/OpenSAMM_Best_Practices_Lessons_from_the_Trenches_-_Seba_Deleersnyder.pdf presentation]) - 2014<br />
* AppSecEU14: Seba Deleersnyder & Bart De Win: OpenSAMM Best Practices: Lessons from the Trenches OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/6/6f/OpenSAMM_-_AppSecEU_2014_-_Seba-Bart_v20140528.pptx presentation], see [https://www.youtube.com/watch?v=qcCgeBeBLUg video]) - 2014<br />
* AppSecEU13 - Hamburg: Seba Deleersnyder presenting a project update (download [https://www.owasp.org/images/3/32/OpenSAMM_-_Project_Status_-_Hamburg_2013.pdf presentation]) - 2013<br />
* OWASP Europe Tour 2013 - Geneva: Seba Deleersnyder presenting OpenSAMM and the renewed project (download [https://www.owasp.org/images/c/cd/OpenSAMM_-_OWASP_Tour_13_Talk_-_Seba.pptx presentation]) - 2013<br />
* AppSecEU11 - Athens: Colin Watson presenting SAMM Training (download [https://www.owasp.org/images/1/18/Owasp-training-samm-greece.pdf presentation]) - 2011<br />
* AppSecEU09: Pravir Chandra presenting OpenSAMM v1.0 (download [https://www.owasp.org/images/4/49/AppSecEU09_OpenSAMM-1.0.ppt presentation]) - 2009<br />
* Matt Bartoldus presentation on new SAMM project during OWASP London chapter (download [https://www.owasp.org/images/d/df/OpenSAMM.pdf presentation]) - 2009<br />
* Pravir Chandra - first presentation discussing the next generation to the CLASP Project- a complete working of the details into a Software Assurance Maturity Model (SAMM). (download [https://www.owasp.org/images/2/2e/OWASP_CLASP_SAMM.ppt presentation]) - 2009<br />
<br />
</div><br />
<br />
= News =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Latest News on SAMM<br />
* OWASP SAMM v2.0 workshop at the OWASP Project Summit June 2017<br />
* OWASP SAMM v1.5 Released!<br />
* SAMM Summit 2016 read the [https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit wrap-up here] <br />
* OWASP SAMM v1.1 Released! See the [http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release].<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
</div><br />
<br />
= Languages =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''SAMM v1.0 is available in the following languages:'''<br />
<br />
* English<br />
* Spanish<br />
* Japanese<br />
* Chinese<br />
<br />
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].<br />
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!<br />
<br />
</div><br />
<br />
= Roadmap =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Updated roadmap:<br />
Next 1.5 release, updated scoring:<br />
* Clarification of maturity levels (syntactic changes to keep the text consistent)<br />
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. <br />
* Show improvements with every activity introduced<br />
* Adapt for the new scoring method<br />
* Update questions for 4-tiers<br />
* Review and where necessary clarify current questions<br />
* Consider v1.1 remarks that were not withheld for the previous release<br />
Targeted completion date: February 28, 2017<br />
<br />
SAMM version 2.0<br />
* Core model changed<br />
* Visualisations + flavours for a few development methodologies<br />
* Update quickstart guide, TB, HTG. <br />
* Success metrics: How well does the model work: Linked to the benchmarking project.<br />
Timing: Workshops as part of OWASP Project Summit June 2017<br />
<br />
</div><br />
= Get Involved =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Involvement in the development of SAMM is actively encouraged!<br />
<br />
You do not have to be a security expert in order to contribute.<br />
<br />
Some of the ways you can help:<br />
<br />
==Feedback==<br />
<br />
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:<br />
* What do like?<br />
* What don't you like?<br />
* How can we make SAMM easier to use?<br />
* How could SAMM be improved? <br />
<br />
<br />
==Localization==<br />
<br />
Are you fluent in another language? Can you help translate SAMM into that language?<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!<br />
<br />
</div><br />
<br />
= Project Sponsors =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
SAMM is developed and maintained by a worldwide team of volunteers. We have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM.<br />
<br />
==SAMM Adopters==<br />
SAMM is the premier open source software assurance framework. You can find a list of [https://www.owasp.org/index.php/OpenSAMM_Adopters SAMM adopters] online.<br />
<br />
==Call for SAMM2 Sponsors==<br />
OWASP SAMM and the upcoming SAMM 2.0 release is the open source software security maturity model used to develop secure software for IT, application and software security technologists. <br />
<br />
We are seeking sponsors to support OWASP SAMM. All proceeds from the sponsorship support the mission of the OWASP Foundation and the further development of SAMM. Supporting the project drives the funding for research grants, SAMM hosting, tools, templates, documents, promotion, and more.<br />
<br />
By sponsoring SAMM, you not only support an important and flagship OWASP project, you will also get visibility during the next SAMM Summit (part of the [https://open-security-summit.org/ Open Security Summit 2019]) and recognition on the OWASP SAMM [https://owaspsamm.org/ web site] and the next release of SAMM (version 2.0).<br />
<br />
For more information: Contact [mailto:seba@owasp.org seba@owasp.org]<br />
<br />
==== Acknowledgements ====<br />
<br />
We would like to thank the following sponsors who donated funds to our project:[[File:Imageedit 15 5335623074.png|none|thumb]][[File:Fortify blue 800px.png|250px|link=https://www.microfocus.com/en-us/solutions/application-security]] <br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
<br /><br />
{{OWASP Book|6888083}}<br />
<br /><br />
<br />
[[Category:OWASP Project|Zed Attack Proxy Project]]<br />
[[Category:OWASP_Tool]]<br />
[[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]]<br />
[[Category:OWASP_Download]]<br />
[[Category:Popular]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:Imageedit_15_5335623074.png&diff=251302File:Imageedit 15 5335623074.png2019-05-10T06:33:41Z<p>Sdeleersnyder: </p>
<hr />
<div>Concord logo</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&diff=251301OWASP SAMM Project2019-05-10T06:28:01Z<p>Sdeleersnyder: </p>
<hr />
<div>= Main = <br />
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''Join us at the Open Security Summit next June'''<br><br />
We have a dedicated [https://opensecuritysummit.org/tracks/owasp-samm/ SAMM track] at the upcoming Open Security Summit (supported by OWASP)!<br><br />
You can register for on-site or remote participation [https://opensecuritysummit.org/tickets/ here].<br><br />
<br />
'''OWASP SAMMv2 beta released for community review'''<br><br />
We are very proud to announce a new version of SAMM!<br><br />
Check it out on our new website: https://owaspsamm.org/.<br><br />
Please, read our notes on how to provide [https://owaspsamm.org/v2.0b/feedback/ feedback].<br />
<br />
'''OWASP SAMM v1.5 available in the downloads section!'''<br><br />
We are now working on the Beta release of OWASP SAMMv2, our work in progress is available [https://owaspsamm.org online on our new web site]. <br><br />
<br />
'''Join our monthly calls'''<br />
* The monthly call is on each 2nd Wednesday of the month at 21h30 CEST / 3:30pm EST. <br><br />
* Please join our GoToMeeting: https://global.gotomeeting.com/join/262891661 <br><br />
* The call is open for everybody interested in SAMM or who wants to work on SAMM. <br><br />
<br />
'''Join us on the OWASP SAMM project Slack channel'''<br />
* Join our project slack channel on https://owasp.slack.com/messages/C0VF1EJGH <br />
* If you do not have an OWASP Slack workspace account yet, contact one of our project leaders to get an invite link.<br />
<br />
'''2019 OWASP SAMM Summit (3-7 JUNE 2019, Bedford, UK)'''<br />
* Join our 2019 OWASP SAMM Summit at Woburn Forest, Bedfordshire as part of the [https://open-security-summit.org/ Open Security Summit].<br />
* We will organize working sessions in a 5-day sprint to draft SAMM v2.0. <br />
* Register online [https://open-security-summit.org/tickets/ here]<br />
* Sponsor the SAMM2, more details [https://www.owasp.org/index.php/OWASP_SAMM_Project#tab=Project_Sponsors here]<br />
<br />
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:<br />
* '''Evaluate an organization’s existing software security practices'''<br />
* '''Build a balanced software security assurance program in well-defined iterations'''<br />
* '''Demonstrate concrete improvements to a security assurance program'''<br />
* '''Define and measure security-related activities throughout an organization'''<br />
<br />
<br />
<br />
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'', ('''Michael J. Craigue, Information Security & Compliance, Dell, Inc.''')<br />
<br />
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]<br />
<br />
{{Social Media Links}}<br />
<br />
| valign="top" style="padding-left:25px;width:200px;" |<br />
<br />
== Quick Download v1.5 ==<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Toolbox Example] <br><br />
[https://github.com/OWASP/samm/ OWASP SAMM on GitHub]<br />
<br />
== Quick Download v1.1.1 ==<br />
<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]<br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box]<br><br />
[https://github.com/OWASP/samm OWASP SAMM on GitHub]<br />
<br />
== News and Events ==<br />
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs<br />
<br />
== Change Log ==<br />
* OWASP SAMM v1.5 Released! ([http://www.prnewswire.com/news-releases/owasp-samm-v15-helps-organizations-improve-their-security-posture-300439237.html Press Release])<br />
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
== Email List ==<br />
<br />
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]<br />
<br />
== Project Leaders ==<br />
<br />
[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] <br /> [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win]<br />
<br />
== Related Projects ==<br />
<br />
*<br />
<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]<br />
| align="center" valign="center" width="50%" | [[File:Owasp-defenders-small.png|link=]]<br />
|<br />
|-<br />
| align="center" valign="center" width="50%" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= Browse Online =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.<br />
<br />
[[Image:SAMM-Overview.png|720px]]<br />
<br />
===== Click on any badge to learn more =====<br />
<br />
{| cellpadding="1"<br />
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]<br />
|-<br />
| align="center" |'''Strategy & Metrics'''<br />
|{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM|padding=0}}<br />
|-<br />
| align="center" |'''Policy & Compliance'''<br />
|{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC|padding=0}}<br />
|-<br />
| align="center" |'''Education & Guidance'''<br />
|{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]<br />
|-<br />
| align="center" |'''Threat Assessment'''<br />
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}<br />
|-<br />
| align="center" |'''Security Requirements'''<br />
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}<br />
|-<br />
| align="center" |'''Secure Architecture'''<br />
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]<br />
|-<br />
| align="center" |'''Design Review'''<br />
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}<br />
|-<br />
| align="center" |'''Code Review'''<br />
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}<br />
|-<br />
| align="center" |'''Security Testing'''<br />
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]<br />
|-<br />
| align="center" |'''Vulnerability Management'''<br />
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}<br />
|-<br />
| align="center" |'''Environment Hardening'''<br />
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}<br />
|-<br />
| align="center" |'''Operational Enablement'''<br />
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}<br />
|-<br />
|}<br />
<br />
= Downloads =<br />
<br />
The latest work in progress can be found on Github: https://github.com/OWASP/samm<br />
<br />
Download SAMM v1.5<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] Zip file containing all the v1.5 files below;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] to perform SAMM assessments and create SAMM roadmaps;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Tool Box Example] to provide an example SAMM assessment;<br />
<br />
Download SAMM v1.1<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;<br />
<br />
Download OpenSAMM v1.0:<br />
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML<br />
* in [https://www.owasp.org/images/f/fd/SAMM-1.0-cn.pdf Chinese - PDF], not available as XML<br />
<br />
<br />
Available resources to apply SAMM:<br />
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]<br />
<br />
<br />
Trainings:<br />
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge<br />
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]<br />
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]<br />
<br />
<br />
Assessments:<br />
* SAMM v1.5 Toolbox<br />
** Download the new v1.5 Toolbox with the updated scoring model [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM v1.5 Toolbox]<br />
* SAMM v1.1 Toolbox<br />
** download the v1.1 toolbox, including the updated questions [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx here]<br />
* Assessment Interview Template by Nick Coblentz for SAMM V1.0<br />
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.<br />
* Roadmap Chart Template by Colin Watson for SAMM V1.0<br />
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.<br />
* Assessment Worksheet by Christian Frichot for SAMM V1.0<br />
** This is an easy-to-use [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.<br />
* Project Plan Template by Jim Weiler for SAMM V1.0<br />
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.<br />
<br />
<br />
Mappings:<br />
* BSIMM-6 mapping to SAMM activities:<br />
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]<br />
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]<br />
* BSIMM mapping to SAMM during the 2011 Summit:<br />
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).<br />
<br />
<br />
Tools:<br />
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]<br />
<br />
= Community =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}<br />
<br />
</div><br />
<br />
= Summit =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
'''Join us at the Open Security Summit next June'''<br><br />
We have a dedicated [https://opensecuritysummit.org/tracks/owasp-samm/ SAMM track] at the upcoming Open Security Summit (supported by OWASP)!<br><br />
You can register for on-site or remote participation [https://opensecuritysummit.org/tickets/ here].<br><br />
<br />
We organised a core team summit in November 2018 in Minneapolis, check out the results [https://github.com/OWASP/samm/blob/master/Supporting%20Resources/v2.0/summit-201810-Minneapolis/Summit-outcomes.md here].<br />
<br />
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 >here<] !!<br />
<br />
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit<br />
<br />
<br />
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 >here<] !!<br />
<br />
Summit Notes:<br />
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit<br />
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]<br />
''"The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers."'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company<br />
<br />
Previous workshop Notes:<br />
<br />
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.<br />
<br />
This is also an excellent opportunity to exchange experiences with your peers.<br />
<br />
If you plan on attending http://appsec.eu be sure to get involved in the SAMM workshop (scheduled on Jun-23).<br />
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].<br />
<br />
Previous workshop notes:<br />
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].<br />
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].<br />
<br />
<br />
= Talks =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
Upcoming talks featuring SAMM are listed here:<br />
<br />
* OWASP DC - Software Assurance Maturity Model (SAMM) with Brian Glas! (2017-03-15)<br />
* OWASP NoVA - SAMM 1.5, what's changed and how it impacts you (2017-03-16)<br />
* InfoSec World - Software Assurance Maturity Model Evolutions (2017-04-03)<br />
<br />
past talks:<br />
<br />
* OWASP SAMM v1.5 Webinar - Brian Glas discussing the SAMM model and changes in v1.5 (watch - [https://www.youtube.com/watch?v=4pKdwRb8fTI youtube]) - 2017<br />
* OWASP 24/7 - Seba Deleersnyder discussing the upcoming SAMM Summit (listen - [https://soundcloud.com/owasp-podcast/seba-deleersnyder-discusses-samm-software-assurance-maturity-model-summit-in-dublin-ireland here]) - 2015<br />
* OWASP Germany Day 2014: Seba Deleersnyder: OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/f/fa/OpenSAMM_Best_Practices_Lessons_from_the_Trenches_-_Seba_Deleersnyder.pdf presentation]) - 2014<br />
* AppSecEU14: Seba Deleersnyder & Bart De Win: OpenSAMM Best Practices: Lessons from the Trenches OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/6/6f/OpenSAMM_-_AppSecEU_2014_-_Seba-Bart_v20140528.pptx presentation], see [https://www.youtube.com/watch?v=qcCgeBeBLUg video]) - 2014<br />
* AppSecEU13 - Hamburg: Seba Deleersnyder presenting a project update (download [https://www.owasp.org/images/3/32/OpenSAMM_-_Project_Status_-_Hamburg_2013.pdf presentation]) - 2013<br />
* OWASP Europe Tour 2013 - Geneva: Seba Deleersnyder presenting OpenSAMM and the renewed project (download [https://www.owasp.org/images/c/cd/OpenSAMM_-_OWASP_Tour_13_Talk_-_Seba.pptx presentation]) - 2013<br />
* AppSecEU11 - Athens: Colin Watson presenting SAMM Training (download [https://www.owasp.org/images/1/18/Owasp-training-samm-greece.pdf presentation]) - 2011<br />
* AppSecEU09: Pravir Chandra presenting OpenSAMM v1.0 (download [https://www.owasp.org/images/4/49/AppSecEU09_OpenSAMM-1.0.ppt presentation]) - 2009<br />
* Matt Bartoldus presentation on new SAMM project during OWASP London chapter (download [https://www.owasp.org/images/d/df/OpenSAMM.pdf presentation]) - 2009<br />
* Pravir Chandra - first presentation discussing the next generation to the CLASP Project- a complete working of the details into a Software Assurance Maturity Model (SAMM). (download [https://www.owasp.org/images/2/2e/OWASP_CLASP_SAMM.ppt presentation]) - 2009<br />
<br />
</div><br />
<br />
= News =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Latest News on SAMM<br />
* OWASP SAMM v2.0 workshop at the OWASP Project Summit June 2017<br />
* OWASP SAMM v1.5 Released!<br />
* SAMM Summit 2016 read the [https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit wrap-up here] <br />
* OWASP SAMM v1.1 Released! See the [http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release].<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
</div><br />
<br />
= Languages =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''SAMM v1.0 is available in the following languages:'''<br />
<br />
* English<br />
* Spanish<br />
* Japanese<br />
* Chinese<br />
<br />
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].<br />
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!<br />
<br />
</div><br />
<br />
= Roadmap =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Updated roadmap:<br />
Next 1.5 release, updated scoring:<br />
* Clarification of maturity levels (syntactic changes to keep the text consistent)<br />
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. <br />
* Show improvements with every activity introduced<br />
* Adapt for the new scoring method<br />
* Update questions for 4-tiers<br />
* Review and where necessary clarify current questions<br />
* Consider v1.1 remarks that were not withheld for the previous release<br />
Targeted completion date: February 28, 2017<br />
<br />
SAMM version 2.0<br />
* Core model changed<br />
* Visualisations + flavours for a few development methodologies<br />
* Update quickstart guide, TB, HTG. <br />
* Success metrics: How well does the model work: Linked to the benchmarking project.<br />
Timing: Workshops as part of OWASP Project Summit June 2017<br />
<br />
</div><br />
= Get Involved =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Involvement in the development of SAMM is actively encouraged!<br />
<br />
You do not have to be a security expert in order to contribute.<br />
<br />
Some of the ways you can help:<br />
<br />
==Feedback==<br />
<br />
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:<br />
* What do like?<br />
* What don't you like?<br />
* How can we make SAMM easier to use?<br />
* How could SAMM be improved? <br />
<br />
<br />
==Localization==<br />
<br />
Are you fluent in another language? Can you help translate SAMM into that language?<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!<br />
<br />
</div><br />
<br />
= Project Sponsors =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
SAMM is developed and maintained by a worldwide team of volunteers. We have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM.<br />
<br />
==SAMM Adopters==<br />
SAMM is the premier open source software assurance framework. You can find a list of [https://www.owasp.org/index.php/OpenSAMM_Adopters SAMM adopters] online.<br />
<br />
==Call for SAMM2 Sponsors==<br />
OWASP SAMM and the upcoming SAMM 2.0 release is the open source software security maturity model used to develop secure software for IT, application and software security technologists. <br />
<br />
We are seeking sponsors to support OWASP SAMM. All proceeds from the sponsorship support the mission of the OWASP Foundation and the further development of SAMM. Supporting the project drives the funding for research grants, SAMM hosting, tools, templates, documents, promotion, and more.<br />
<br />
By sponsoring SAMM, you not only support an important and flagship OWASP project, you will also get visibility during the next SAMM Summit (part of the [https://open-security-summit.org/ Open Security Summit 2019]) and recognition on the OWASP SAMM [https://owaspsamm.org/ web site] and the next release of SAMM (version 2.0).<br />
<br />
For more information: Contact [mailto:seba@owasp.org seba@owasp.org]<br />
<br />
==== Acknowledgements ====<br />
<br />
We would like to thank the following sponsors who donated funds to our project:<br />
<br />
[[File:Fortify blue 800px.png|250px|link=https://www.microfocus.com/en-us/solutions/application-security]] <br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
<br /><br />
{{OWASP Book|6888083}}<br />
<br /><br />
<br />
[[Category:OWASP Project|Zed Attack Proxy Project]]<br />
[[Category:OWASP_Tool]]<br />
[[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]]<br />
[[Category:OWASP_Download]]<br />
[[Category:Popular]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&diff=251300OWASP SAMM Project2019-05-10T06:22:35Z<p>Sdeleersnyder: </p>
<hr />
<div>= Main = <br />
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''Join us at the Open Security Summit next June'''<br><br />
We have a dedicated [https://opensecuritysummit.org/tracks/owasp-samm/ SAMM track] at the upcoming Open Security Summit (supported by OWASP)!<br><br />
You can register for on-site or remote participation [https://opensecuritysummit.org/tickets/ here].<br><br />
<br />
'''OWASP SAMMv2 beta released for community review'''<br><br />
We are very proud to announce a new version of SAMM!<br><br />
Check it out on our new website: https://owaspsamm.org/.<br><br />
Please, read our notes on how to provide [https://owaspsamm.org/v2.0b/feedback/ feedback].<br />
<br />
'''OWASP SAMM v1.5 available in the downloads section!'''<br><br />
We are now working on the Beta release of OWASP SAMMv2, our work in progress is available [https://owaspsamm.org online on our new web site]. <br><br />
<br />
'''Join our monthly calls'''<br />
* The monthly call is on each 2nd Wednesday of the month at 21h30 CEST / 3:30pm EST. <br><br />
* Please join our GoToMeeting: https://global.gotomeeting.com/join/262891661 <br><br />
* The call is open for everybody interested in SAMM or who wants to work on SAMM. <br><br />
<br />
'''Join us on the OWASP SAMM project Slack channel'''<br />
* Join our project slack channel on https://owasp.slack.com/messages/C0VF1EJGH <br />
* If you do not have an OWASP Slack workspace account yet, contact one of our project leaders to get an invite link.<br />
<br />
'''2019 OWASP SAMM Summit (3-7 JUNE 2018, London)'''<br />
* Join our 20189 OWASP SAMM Summit near London as part of the [https://open-security-summit.org/ Open Security Summit].<br />
* We will organize working sessions in a 5-day sprint to draft SAMM v2.0. <br />
* Register online [https://open-security-summit.org/tickets/ here]<br />
* Sponsor the SAMM2, more details [https://www.owasp.org/index.php/OWASP_SAMM_Project#tab=Project_Sponsors here]<br />
<br />
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:<br />
* '''Evaluate an organization’s existing software security practices'''<br />
* '''Build a balanced software security assurance program in well-defined iterations'''<br />
* '''Demonstrate concrete improvements to a security assurance program'''<br />
* '''Define and measure security-related activities throughout an organization'''<br />
<br />
<br />
<br />
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'', ('''Michael J. Craigue, Information Security & Compliance, Dell, Inc.''')<br />
<br />
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]<br />
<br />
{{Social Media Links}}<br />
<br />
| valign="top" style="padding-left:25px;width:200px;" |<br />
<br />
== Quick Download v1.5 ==<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Toolbox Example] <br><br />
[https://github.com/OWASP/samm/ OWASP SAMM on GitHub]<br />
<br />
== Quick Download v1.1.1 ==<br />
<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]<br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box]<br><br />
[https://github.com/OWASP/samm OWASP SAMM on GitHub]<br />
<br />
== News and Events ==<br />
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs<br />
<br />
== Change Log ==<br />
* OWASP SAMM v1.5 Released! ([http://www.prnewswire.com/news-releases/owasp-samm-v15-helps-organizations-improve-their-security-posture-300439237.html Press Release])<br />
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
== Email List ==<br />
<br />
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]<br />
<br />
== Project Leaders ==<br />
<br />
[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] <br /> [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win]<br />
<br />
== Related Projects ==<br />
<br />
*<br />
<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]<br />
| align="center" valign="center" width="50%" | [[File:Owasp-defenders-small.png|link=]]<br />
|<br />
|-<br />
| align="center" valign="center" width="50%" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= Browse Online =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.<br />
<br />
[[Image:SAMM-Overview.png|720px]]<br />
<br />
===== Click on any badge to learn more =====<br />
<br />
{| cellpadding="1"<br />
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]<br />
|-<br />
| align="center" |'''Strategy & Metrics'''<br />
|{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM|padding=0}}<br />
|-<br />
| align="center" |'''Policy & Compliance'''<br />
|{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC|padding=0}}<br />
|-<br />
| align="center" |'''Education & Guidance'''<br />
|{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]<br />
|-<br />
| align="center" |'''Threat Assessment'''<br />
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}<br />
|-<br />
| align="center" |'''Security Requirements'''<br />
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}<br />
|-<br />
| align="center" |'''Secure Architecture'''<br />
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]<br />
|-<br />
| align="center" |'''Design Review'''<br />
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}<br />
|-<br />
| align="center" |'''Code Review'''<br />
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}<br />
|-<br />
| align="center" |'''Security Testing'''<br />
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]<br />
|-<br />
| align="center" |'''Vulnerability Management'''<br />
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}<br />
|-<br />
| align="center" |'''Environment Hardening'''<br />
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}<br />
|-<br />
| align="center" |'''Operational Enablement'''<br />
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}<br />
|-<br />
|}<br />
<br />
= Downloads =<br />
<br />
The latest work in progress can be found on Github: https://github.com/OWASP/samm<br />
<br />
Download SAMM v1.5<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] Zip file containing all the v1.5 files below;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] to perform SAMM assessments and create SAMM roadmaps;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Tool Box Example] to provide an example SAMM assessment;<br />
<br />
Download SAMM v1.1<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;<br />
<br />
Download OpenSAMM v1.0:<br />
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML<br />
* in [https://www.owasp.org/images/f/fd/SAMM-1.0-cn.pdf Chinese - PDF], not available as XML<br />
<br />
<br />
Available resources to apply SAMM:<br />
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]<br />
<br />
<br />
Trainings:<br />
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge<br />
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]<br />
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]<br />
<br />
<br />
Assessments:<br />
* SAMM v1.5 Toolbox<br />
** Download the new v1.5 Toolbox with the updated scoring model [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM v1.5 Toolbox]<br />
* SAMM v1.1 Toolbox<br />
** download the v1.1 toolbox, including the updated questions [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx here]<br />
* Assessment Interview Template by Nick Coblentz for SAMM V1.0<br />
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.<br />
* Roadmap Chart Template by Colin Watson for SAMM V1.0<br />
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.<br />
* Assessment Worksheet by Christian Frichot for SAMM V1.0<br />
** This is an easy-to-use [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.<br />
* Project Plan Template by Jim Weiler for SAMM V1.0<br />
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.<br />
<br />
<br />
Mappings:<br />
* BSIMM-6 mapping to SAMM activities:<br />
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]<br />
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]<br />
* BSIMM mapping to SAMM during the 2011 Summit:<br />
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).<br />
<br />
<br />
Tools:<br />
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]<br />
<br />
= Community =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}<br />
<br />
</div><br />
<br />
= Summit =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
'''Join us at the Open Security Summit next June'''<br><br />
We have a dedicated [https://opensecuritysummit.org/tracks/owasp-samm/ SAMM track] at the upcoming Open Security Summit (supported by OWASP)!<br><br />
You can register for on-site or remote participation [https://opensecuritysummit.org/tickets/ here].<br><br />
<br />
We organised a core team summit in November 2018 in Minneapolis, check out the results [https://github.com/OWASP/samm/blob/master/Supporting%20Resources/v2.0/summit-201810-Minneapolis/Summit-outcomes.md here].<br />
<br />
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 >here<] !!<br />
<br />
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit<br />
<br />
<br />
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 >here<] !!<br />
<br />
Summit Notes:<br />
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit<br />
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]<br />
''"The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers."'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company<br />
<br />
Previous workshop Notes:<br />
<br />
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.<br />
<br />
This is also an excellent opportunity to exchange experiences with your peers.<br />
<br />
If you plan on attending http://appsec.eu be sure to get involved in the SAMM workshop (scheduled on Jun-23).<br />
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].<br />
<br />
Previous workshop notes:<br />
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].<br />
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].<br />
<br />
<br />
= Talks =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
Upcoming talks featuring SAMM are listed here:<br />
<br />
* OWASP DC - Software Assurance Maturity Model (SAMM) with Brian Glas! (2017-03-15)<br />
* OWASP NoVA - SAMM 1.5, what's changed and how it impacts you (2017-03-16)<br />
* InfoSec World - Software Assurance Maturity Model Evolutions (2017-04-03)<br />
<br />
past talks:<br />
<br />
* OWASP SAMM v1.5 Webinar - Brian Glas discussing the SAMM model and changes in v1.5 (watch - [https://www.youtube.com/watch?v=4pKdwRb8fTI youtube]) - 2017<br />
* OWASP 24/7 - Seba Deleersnyder discussing the upcoming SAMM Summit (listen - [https://soundcloud.com/owasp-podcast/seba-deleersnyder-discusses-samm-software-assurance-maturity-model-summit-in-dublin-ireland here]) - 2015<br />
* OWASP Germany Day 2014: Seba Deleersnyder: OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/f/fa/OpenSAMM_Best_Practices_Lessons_from_the_Trenches_-_Seba_Deleersnyder.pdf presentation]) - 2014<br />
* AppSecEU14: Seba Deleersnyder & Bart De Win: OpenSAMM Best Practices: Lessons from the Trenches OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/6/6f/OpenSAMM_-_AppSecEU_2014_-_Seba-Bart_v20140528.pptx presentation], see [https://www.youtube.com/watch?v=qcCgeBeBLUg video]) - 2014<br />
* AppSecEU13 - Hamburg: Seba Deleersnyder presenting a project update (download [https://www.owasp.org/images/3/32/OpenSAMM_-_Project_Status_-_Hamburg_2013.pdf presentation]) - 2013<br />
* OWASP Europe Tour 2013 - Geneva: Seba Deleersnyder presenting OpenSAMM and the renewed project (download [https://www.owasp.org/images/c/cd/OpenSAMM_-_OWASP_Tour_13_Talk_-_Seba.pptx presentation]) - 2013<br />
* AppSecEU11 - Athens: Colin Watson presenting SAMM Training (download [https://www.owasp.org/images/1/18/Owasp-training-samm-greece.pdf presentation]) - 2011<br />
* AppSecEU09: Pravir Chandra presenting OpenSAMM v1.0 (download [https://www.owasp.org/images/4/49/AppSecEU09_OpenSAMM-1.0.ppt presentation]) - 2009<br />
* Matt Bartoldus presentation on new SAMM project during OWASP London chapter (download [https://www.owasp.org/images/d/df/OpenSAMM.pdf presentation]) - 2009<br />
* Pravir Chandra - first presentation discussing the next generation to the CLASP Project- a complete working of the details into a Software Assurance Maturity Model (SAMM). (download [https://www.owasp.org/images/2/2e/OWASP_CLASP_SAMM.ppt presentation]) - 2009<br />
<br />
</div><br />
<br />
= News =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Latest News on SAMM<br />
* OWASP SAMM v2.0 workshop at the OWASP Project Summit June 2017<br />
* OWASP SAMM v1.5 Released!<br />
* SAMM Summit 2016 read the [https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit wrap-up here] <br />
* OWASP SAMM v1.1 Released! See the [http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release].<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
</div><br />
<br />
= Languages =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''SAMM v1.0 is available in the following languages:'''<br />
<br />
* English<br />
* Spanish<br />
* Japanese<br />
* Chinese<br />
<br />
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].<br />
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!<br />
<br />
</div><br />
<br />
= Roadmap =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Updated roadmap:<br />
Next 1.5 release, updated scoring:<br />
* Clarification of maturity levels (syntactic changes to keep the text consistent)<br />
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. <br />
* Show improvements with every activity introduced<br />
* Adapt for the new scoring method<br />
* Update questions for 4-tiers<br />
* Review and where necessary clarify current questions<br />
* Consider v1.1 remarks that were not withheld for the previous release<br />
Targeted completion date: February 28, 2017<br />
<br />
SAMM version 2.0<br />
* Core model changed<br />
* Visualisations + flavours for a few development methodologies<br />
* Update quickstart guide, TB, HTG. <br />
* Success metrics: How well does the model work: Linked to the benchmarking project.<br />
Timing: Workshops as part of OWASP Project Summit June 2017<br />
<br />
</div><br />
= Get Involved =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Involvement in the development of SAMM is actively encouraged!<br />
<br />
You do not have to be a security expert in order to contribute.<br />
<br />
Some of the ways you can help:<br />
<br />
==Feedback==<br />
<br />
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:<br />
* What do like?<br />
* What don't you like?<br />
* How can we make SAMM easier to use?<br />
* How could SAMM be improved? <br />
<br />
<br />
==Localization==<br />
<br />
Are you fluent in another language? Can you help translate SAMM into that language?<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!<br />
<br />
</div><br />
<br />
= Project Sponsors =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
SAMM is developed and maintained by a worldwide team of volunteers. We have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM.<br />
<br />
==SAMM Adopters==<br />
SAMM is the premier open source software assurance framework. You can find a list of [https://www.owasp.org/index.php/OpenSAMM_Adopters SAMM adopters] online.<br />
<br />
==Call for SAMM2 Sponsors==<br />
OWASP SAMM and the upcoming SAMM 2.0 release is the open source software security maturity model used to develop secure software for IT, application and software security technologists. <br />
<br />
We are seeking sponsors to support OWASP SAMM. All proceeds from the sponsorship support the mission of the OWASP Foundation and the further development of SAMM. Supporting the project drives the funding for research grants, SAMM hosting, tools, templates, documents, promotion, and more.<br />
<br />
By sponsoring SAMM, you not only support an important and flagship OWASP project, you will also get visibility during the next SAMM Summit (part of the [https://open-security-summit.org/ Open Security Summit 2019]) and recognition on the OWASP SAMM [https://owaspsamm.org/ web site] and the next release of SAMM (version 2.0).<br />
<br />
For more information: Contact [mailto:seba@owasp.org seba@owasp.org]<br />
<br />
==== Acknowledgements ====<br />
<br />
We would like to thank the following sponsors who donated funds to our project:<br />
<br />
[[File:Fortify blue 800px.png|250px|link=https://www.microfocus.com/en-us/solutions/application-security]] <br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
<br /><br />
{{OWASP Book|6888083}}<br />
<br /><br />
<br />
[[Category:OWASP Project|Zed Attack Proxy Project]]<br />
[[Category:OWASP_Tool]]<br />
[[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]]<br />
[[Category:OWASP_Download]]<br />
[[Category:Popular]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&diff=251299OWASP SAMM Project2019-05-10T06:03:25Z<p>Sdeleersnyder: </p>
<hr />
<div>= Main = <br />
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''Join us at the Open Security Summit next June'''<br><br />
We have a dedicated [https://opensecuritysummit.org/tracks/owasp-samm/ SAMM track] at the upcoming Open Security Summit (supported by OWASP)!<br><br />
You can register for on-site or remote participation [https://opensecuritysummit.org/tickets/ here].<br><br />
<br />
'''OWASP SAMMv2 beta released for community review'''<br><br />
We are very proud to announce a new version of SAMM!<br><br />
Check it out on our new website: [https://owaspsamm.org/ https://owaspsamm.org/].<br><br />
Please, read our notes on how to provide [https://owaspsamm.org/v2.0b/feedback/ feedback].<br />
<br />
'''OWASP SAMM v1.5 available in the downloads section!'''<br><br />
We are now working on the Beta release of OWASP SAMMv2, our work in progress is available [https://owaspsamm.org online on our new web site]. <br><br />
<br />
'''Join our monthly calls'''<br />
* The monthly call is on each 2nd Wednesday of the month at 21h30 CEST / 3:30pm EST. <br><br />
* Please join our GoToMeeting: https://global.gotomeeting.com/join/262891661 <br><br />
* The call is open for everybody interested in SAMM or who wants to work on SAMM. <br><br />
<br />
'''Join us on the OWASP SAMM project Slack channel'''<br />
* Join our project slack channel on https://owasp.slack.com/messages/C0VF1EJGH <br />
* If you do not have an OWASP Slack workspace account yet, contact one of our project leaders to get an invite link.<br />
<br />
'''2018 OWASP SAMM Summit (4-8 JUNE 2018, London)'''<br />
* Join our 2018 OWASP SAMM Summit near London as part of the [https://open-security-summit.org/ Open Security Summit].<br><br />
* We will organize working sessions in a 5-day sprint to draft SAMM v2.0. <br />
* Register online [https://open-security-summit.org/tickets/ here]<br />
* Sponsor the SAMM2, more details [https://www.owasp.org/index.php/OWASP_SAMM_Project#tab=Project_Sponsors here]<br />
<br />
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:<br />
* '''Evaluate an organization’s existing software security practices'''<br />
* '''Build a balanced software security assurance program in well-defined iterations'''<br />
* '''Demonstrate concrete improvements to a security assurance program'''<br />
* '''Define and measure security-related activities throughout an organization'''<br />
<br />
<br />
<br />
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'', ('''Michael J. Craigue, Information Security & Compliance, Dell, Inc.''')<br />
<br />
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]<br />
<br />
{{Social Media Links}}<br />
<br />
| valign="top" style="padding-left:25px;width:200px;" |<br />
<br />
== Quick Download v1.5 ==<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Toolbox Example] <br><br />
[https://github.com/OWASP/samm/ OWASP SAMM on GitHub]<br />
<br />
== Quick Download v1.1.1 ==<br />
<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]<br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box]<br><br />
[https://github.com/OWASP/samm OWASP SAMM on GitHub]<br />
<br />
== News and Events ==<br />
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs<br />
<br />
== Change Log ==<br />
* OWASP SAMM v1.5 Released! ([http://www.prnewswire.com/news-releases/owasp-samm-v15-helps-organizations-improve-their-security-posture-300439237.html Press Release])<br />
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
== Email List ==<br />
<br />
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]<br />
<br />
== Project Leaders ==<br />
<br />
[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] <br /> [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win]<br />
<br />
== Related Projects ==<br />
<br />
*<br />
<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]<br />
| align="center" valign="center" width="50%" | [[File:Owasp-defenders-small.png|link=]]<br />
|<br />
|-<br />
| align="center" valign="center" width="50%" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= Browse Online =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.<br />
<br />
[[Image:SAMM-Overview.png|720px]]<br />
<br />
===== Click on any badge to learn more =====<br />
<br />
{| cellpadding="1"<br />
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]<br />
|-<br />
| align="center" |'''Strategy & Metrics'''<br />
|{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM|padding=0}}<br />
|-<br />
| align="center" |'''Policy & Compliance'''<br />
|{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC|padding=0}}<br />
|-<br />
| align="center" |'''Education & Guidance'''<br />
|{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]<br />
|-<br />
| align="center" |'''Threat Assessment'''<br />
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}<br />
|-<br />
| align="center" |'''Security Requirements'''<br />
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}<br />
|-<br />
| align="center" |'''Secure Architecture'''<br />
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]<br />
|-<br />
| align="center" |'''Design Review'''<br />
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}<br />
|-<br />
| align="center" |'''Code Review'''<br />
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}<br />
|-<br />
| align="center" |'''Security Testing'''<br />
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]<br />
|-<br />
| align="center" |'''Vulnerability Management'''<br />
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}<br />
|-<br />
| align="center" |'''Environment Hardening'''<br />
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}<br />
|-<br />
| align="center" |'''Operational Enablement'''<br />
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}<br />
|-<br />
|}<br />
<br />
= Downloads =<br />
<br />
The latest work in progress can be found on Github: https://github.com/OWASP/samm<br />
<br />
Download SAMM v1.5<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] Zip file containing all the v1.5 files below;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] to perform SAMM assessments and create SAMM roadmaps;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Tool Box Example] to provide an example SAMM assessment;<br />
<br />
Download SAMM v1.1<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;<br />
<br />
Download OpenSAMM v1.0:<br />
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML<br />
* in [https://www.owasp.org/images/f/fd/SAMM-1.0-cn.pdf Chinese - PDF], not available as XML<br />
<br />
<br />
Available resources to apply SAMM:<br />
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]<br />
<br />
<br />
Trainings:<br />
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge<br />
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]<br />
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]<br />
<br />
<br />
Assessments:<br />
* SAMM v1.5 Toolbox<br />
** Download the new v1.5 Toolbox with the updated scoring model [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM v1.5 Toolbox]<br />
* SAMM v1.1 Toolbox<br />
** download the v1.1 toolbox, including the updated questions [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx here]<br />
* Assessment Interview Template by Nick Coblentz for SAMM V1.0<br />
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.<br />
* Roadmap Chart Template by Colin Watson for SAMM V1.0<br />
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.<br />
* Assessment Worksheet by Christian Frichot for SAMM V1.0<br />
** This is an easy-to-use [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.<br />
* Project Plan Template by Jim Weiler for SAMM V1.0<br />
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.<br />
<br />
<br />
Mappings:<br />
* BSIMM-6 mapping to SAMM activities:<br />
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]<br />
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]<br />
* BSIMM mapping to SAMM during the 2011 Summit:<br />
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).<br />
<br />
<br />
Tools:<br />
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]<br />
<br />
= Community =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}<br />
<br />
</div><br />
<br />
= Summit =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
'''Join us at the Open Security Summit next June'''<br><br />
We have a dedicated [https://opensecuritysummit.org/tracks/owasp-samm/ SAMM track] at the upcoming Open Security Summit (supported by OWASP)!<br><br />
You can register for on-site or remote participation [https://opensecuritysummit.org/tickets/ here].<br><br />
<br />
We organised a core team summit in November 2018 in Minneapolis, check out the results [https://github.com/OWASP/samm/blob/master/Supporting%20Resources/v2.0/summit-201810-Minneapolis/Summit-outcomes.md here].<br />
<br />
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 >here<] !!<br />
<br />
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit<br />
<br />
<br />
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 >here<] !!<br />
<br />
Summit Notes:<br />
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit<br />
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]<br />
''"The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers."'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company<br />
<br />
Previous workshop Notes:<br />
<br />
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.<br />
<br />
This is also an excellent opportunity to exchange experiences with your peers.<br />
<br />
If you plan on attending http://appsec.eu be sure to get involved in the SAMM workshop (scheduled on Jun-23).<br />
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].<br />
<br />
Previous workshop notes:<br />
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].<br />
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].<br />
<br />
<br />
= Talks =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
Upcoming talks featuring SAMM are listed here:<br />
<br />
* OWASP DC - Software Assurance Maturity Model (SAMM) with Brian Glas! (2017-03-15)<br />
* OWASP NoVA - SAMM 1.5, what's changed and how it impacts you (2017-03-16)<br />
* InfoSec World - Software Assurance Maturity Model Evolutions (2017-04-03)<br />
<br />
past talks:<br />
<br />
* OWASP SAMM v1.5 Webinar - Brian Glas discussing the SAMM model and changes in v1.5 (watch - [https://www.youtube.com/watch?v=4pKdwRb8fTI youtube]) - 2017<br />
* OWASP 24/7 - Seba Deleersnyder discussing the upcoming SAMM Summit (listen - [https://soundcloud.com/owasp-podcast/seba-deleersnyder-discusses-samm-software-assurance-maturity-model-summit-in-dublin-ireland here]) - 2015<br />
* OWASP Germany Day 2014: Seba Deleersnyder: OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/f/fa/OpenSAMM_Best_Practices_Lessons_from_the_Trenches_-_Seba_Deleersnyder.pdf presentation]) - 2014<br />
* AppSecEU14: Seba Deleersnyder & Bart De Win: OpenSAMM Best Practices: Lessons from the Trenches OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/6/6f/OpenSAMM_-_AppSecEU_2014_-_Seba-Bart_v20140528.pptx presentation], see [https://www.youtube.com/watch?v=qcCgeBeBLUg video]) - 2014<br />
* AppSecEU13 - Hamburg: Seba Deleersnyder presenting a project update (download [https://www.owasp.org/images/3/32/OpenSAMM_-_Project_Status_-_Hamburg_2013.pdf presentation]) - 2013<br />
* OWASP Europe Tour 2013 - Geneva: Seba Deleersnyder presenting OpenSAMM and the renewed project (download [https://www.owasp.org/images/c/cd/OpenSAMM_-_OWASP_Tour_13_Talk_-_Seba.pptx presentation]) - 2013<br />
* AppSecEU11 - Athens: Colin Watson presenting SAMM Training (download [https://www.owasp.org/images/1/18/Owasp-training-samm-greece.pdf presentation]) - 2011<br />
* AppSecEU09: Pravir Chandra presenting OpenSAMM v1.0 (download [https://www.owasp.org/images/4/49/AppSecEU09_OpenSAMM-1.0.ppt presentation]) - 2009<br />
* Matt Bartoldus presentation on new SAMM project during OWASP London chapter (download [https://www.owasp.org/images/d/df/OpenSAMM.pdf presentation]) - 2009<br />
* Pravir Chandra - first presentation discussing the next generation to the CLASP Project- a complete working of the details into a Software Assurance Maturity Model (SAMM). (download [https://www.owasp.org/images/2/2e/OWASP_CLASP_SAMM.ppt presentation]) - 2009<br />
<br />
</div><br />
<br />
= News =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Latest News on SAMM<br />
* OWASP SAMM v2.0 workshop at the OWASP Project Summit June 2017<br />
* OWASP SAMM v1.5 Released!<br />
* SAMM Summit 2016 read the [https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit wrap-up here] <br />
* OWASP SAMM v1.1 Released! See the [http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release].<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
</div><br />
<br />
= Languages =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''SAMM v1.0 is available in the following languages:'''<br />
<br />
* English<br />
* Spanish<br />
* Japanese<br />
* Chinese<br />
<br />
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].<br />
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!<br />
<br />
</div><br />
<br />
= Roadmap =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Updated roadmap:<br />
Next 1.5 release, updated scoring:<br />
* Clarification of maturity levels (syntactic changes to keep the text consistent)<br />
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. <br />
* Show improvements with every activity introduced<br />
* Adapt for the new scoring method<br />
* Update questions for 4-tiers<br />
* Review and where necessary clarify current questions<br />
* Consider v1.1 remarks that were not withheld for the previous release<br />
Targeted completion date: February 28, 2017<br />
<br />
SAMM version 2.0<br />
* Core model changed<br />
* Visualisations + flavours for a few development methodologies<br />
* Update quickstart guide, TB, HTG. <br />
* Success metrics: How well does the model work: Linked to the benchmarking project.<br />
Timing: Workshops as part of OWASP Project Summit June 2017<br />
<br />
</div><br />
= Get Involved =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Involvement in the development of SAMM is actively encouraged!<br />
<br />
You do not have to be a security expert in order to contribute.<br />
<br />
Some of the ways you can help:<br />
<br />
==Feedback==<br />
<br />
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:<br />
* What do like?<br />
* What don't you like?<br />
* How can we make SAMM easier to use?<br />
* How could SAMM be improved? <br />
<br />
<br />
==Localization==<br />
<br />
Are you fluent in another language? Can you help translate SAMM into that language?<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!<br />
<br />
</div><br />
<br />
= Project Sponsors =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
SAMM is developed and maintained by a worldwide team of volunteers. We have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM.<br />
<br />
==SAMM Adopters==<br />
SAMM is the premier open source software assurance framework. You can find a list of [https://www.owasp.org/index.php/OpenSAMM_Adopters SAMM adopters] online.<br />
<br />
==Call for SAMM2 Sponsors==<br />
OWASP SAMM and the upcoming SAMM 2.0 release is the open source software security maturity model used to develop secure software for IT, application and software security technologists. <br />
<br />
We are seeking sponsors to support OWASP SAMM. All proceeds from the sponsorship support the mission of the OWASP Foundation and the further development of SAMM. Supporting the project drives the funding for research grants, SAMM hosting, tools, templates, documents, promotion, and more.<br />
<br />
By sponsoring SAMM, you not only support an important and flagship OWASP project, you will also get visibility during the next SAMM Summit (part of the [https://open-security-summit.org/ Open Security Summit 2019]) and recognition on the OWASP SAMM [https://owaspsamm.org/ web site] and the next release of SAMM (version 2.0).<br />
<br />
For more information: Contact [mailto:seba@owasp.org seba@owasp.org]<br />
<br />
==== Acknowledgements ====<br />
<br />
We would like to thank the following sponsors who donated funds to our project:<br />
<br />
[[File:Fortify blue 800px.png|250px|link=https://www.microfocus.com/en-us/solutions/application-security]] <br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
<br /><br />
{{OWASP Book|6888083}}<br />
<br /><br />
<br />
[[Category:OWASP Project|Zed Attack Proxy Project]]<br />
[[Category:OWASP_Tool]]<br />
[[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]]<br />
[[Category:OWASP_Download]]<br />
[[Category:Popular]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=Belgium&diff=250232Belgium2019-04-17T13:00:37Z<p>Sdeleersnyder: </p>
<hr />
<div>{{Chapter Template|chaptername=Belgium|extra=The chapter leaders are [mailto:seba@owasp.org Sebastien Deleersnyder], [mailto:lieven.desmet@owasp.org Lieven Desmet] and [mailto:bart.dewin@owasp.org Bart De Win]<br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-belgium|emailarchives=http://lists.owasp.org/pipermail/owasp-belgium}} <br />
<br />
= Local News =<br />
<br />
== Upcoming Chapter Meetings ==<br />
<br />
* OWASP Belgium presents a summit working session on OWASP SAMM in Antwerp on 30 April: Registration via https://www.eventbrite.com/e/open-security-summit-working-session-tickets-60456102831<br />
<br />
See https://www.owasp.org/index.php/Belgium#Chapter_Meetings for more details and older meetings.<br />
<br />
== Stay in Touch ==<br />
<br />
<center><br />
{| cellspacing="15"<br />
|-<br />
| [[Image:Meetup-logo-2x.png|120px|link=http://www.meetup.com/Belgium-OWASP-Open-Web-Application-Security-Project/]] <br />
| [[Image:Join the list.png|150px|link=http://lists.owasp.org/mailman/listinfo/owasp-belgium]] <br />
| [[Image:Follow-us-on-twitter.png|175px|link=https://twitter.com/owasp_be]]<br />
| [[Image:Linkedin-button.gif|135px|link=https://www.linkedin.com/groups/37865]]<br />
|}<br />
</center><br />
If you want to be invited for the next OWASP Belgium Chapter meetings, please [http://eepurl.com/iFZtb drop us your contact info].<br />
<br />
== Structural Sponsors 2019 ==<br />
<br />
OWASP Belgium thanks its structural chapter supporters for 2019 and the OWASP BeNeLux Days 2018: <br />
<br />
<!-- Gold --><br />
[[File:Vest.jpg|250px|link=http://www.vest.nl]]<br />
[[File:DavinsiLabs.png|250px|link=https://www.davinsilabs.com]]<br />
<br />
<!-- Silver --><br />
[[File:LogoToreon.jpg|250px|link=https://www.toreon.com]] <br />
[[File:Nviso_logo_RGB_baseline_200px.png|250px|link=http://www.nviso.be]] <br />
&nbsp;[[File:LogoIngenicoGroup.png|250px|link=https://ingenico.be]]<br />
<br />
If you want to support our chapter, please contact [mailto:seba@owasp.org Seba Deleersnyder]<br />
<br />
= Chapter Meetings =<br />
<br />
{{:Belgium_Events_2019}}<br />
<br />
== Previous Years ==<br />
<br />
Events held in<br />
[[Belgium Events 2018|2018]],<br />
[[Belgium Events 2017|2017]],<br />
[[Belgium Events 2016|2016]],<br />
[[Belgium Events 2015|2015]],<br />
[[Belgium Events 2014|2014]],<br />
[[Belgium Events 2013|2013]],<br />
[[Belgium Events 2012|2012]],<br />
[[Belgium Events 2011|2011]],<br />
[[Belgium Events 2010|2010]],<br />
[[Belgium Events 2009|2009]],<br />
[[Belgium Events 2008|2008]],<br />
[[Belgium Events 2007|2007]],<br />
[[Belgium Events 2006|2006]],<br />
[[Belgium Events 2005|2005]].<br />
<br />
= Belgium OWASP Chapter Leaders =<br />
<br />
The Belgium Chapter is supported by the following board: <br />
<br />
Chapter Leaders<br />
*Sebastien Deleersnyder, Toreon<br />
*Lieven Desmet, KU Leuven <br />
*Bart De Win, PWC<br />
<br />
Board Members<br />
*Erwin Geirnaert, Zion Security<br />
*David Mathy, Freelance<br />
*Adolfo Solero, Freelance<br />
*Stella Dineva, Ingenico Payment Services<br />
*Thomas Herlea, NVISO<br />
<br />
Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects. <br />
__NOTOC__ <headertabs></headertabs><br />
[[Category:Europe]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&diff=248582OWASP SAMM Project2019-03-09T07:07:08Z<p>Sdeleersnyder: </p>
<hr />
<div>= Main = <br />
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''OWASP SAMMv2 beta released for community review'''<br><br />
We are very proud to announce a new version of SAMM!<br><br />
Check it out on our new website: [https://owaspsamm.org/ https://owaspsamm.org/].<br><br />
Please, read our notes on how to provide [https://owaspsamm.org/v2.0b/feedback/ feedback].<br />
<br />
'''OWASP SAMM v1.5 available in the downloads section!'''<br><br />
We are now working on the Beta release of OWASP SAMMv2, our work in progress is available [https://owaspsamm.org online on our new web site]. <br><br />
<br />
'''Join our monthly calls'''<br />
* The monthly call is on each 2nd Wednesday of the month at 21h30 CEST / 3:30pm EST. <br><br />
* Please join our GoToMeeting: https://global.gotomeeting.com/join/262891661 <br><br />
* The call is open for everybody interested in SAMM or who wants to work on SAMM. <br><br />
<br />
'''Join us on the OWASP SAMM project Slack channel'''<br />
* Join our project slack channel on https://owasp.slack.com/messages/C0VF1EJGH <br />
* If you do not have an OWASP Slack workspace account yet, contact one of our project leaders to get an invite link.<br />
<br />
'''2018 OWASP SAMM Summit (4-8 JUNE 2018, London)'''<br />
* Join our 2018 OWASP SAMM Summit near London as part of the [https://open-security-summit.org/ Open Security Summit].<br><br />
* We will organize working sessions in a 5-day sprint to draft SAMM v2.0. <br />
* Register online [https://open-security-summit.org/tickets/ here]<br />
* Sponsor the SAMM2, more details [https://www.owasp.org/index.php/OWASP_SAMM_Project#tab=Project_Sponsors here]<br />
<br />
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:<br />
* '''Evaluate an organization’s existing software security practices'''<br />
* '''Build a balanced software security assurance program in well-defined iterations'''<br />
* '''Demonstrate concrete improvements to a security assurance program'''<br />
* '''Define and measure security-related activities throughout an organization'''<br />
<br />
<br />
<br />
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'', ('''Michael J. Craigue, Information Security & Compliance, Dell, Inc.''')<br />
<br />
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]<br />
<br />
{{Social Media Links}}<br />
<br />
| valign="top" style="padding-left:25px;width:200px;" |<br />
<br />
== Quick Download v1.5 ==<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Toolbox Example] <br><br />
[https://github.com/OWASP/samm/ OWASP SAMM on GitHub]<br />
<br />
== Quick Download v1.1.1 ==<br />
<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]<br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box]<br><br />
[https://github.com/OWASP/samm OWASP SAMM on GitHub]<br />
<br />
== News and Events ==<br />
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs<br />
<br />
== Change Log ==<br />
* OWASP SAMM v1.5 Released! ([http://www.prnewswire.com/news-releases/owasp-samm-v15-helps-organizations-improve-their-security-posture-300439237.html Press Release])<br />
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
== Email List ==<br />
<br />
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]<br />
<br />
== Project Leaders ==<br />
<br />
[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] <br /> [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win]<br />
<br />
== Related Projects ==<br />
<br />
*<br />
<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]<br />
| align="center" valign="center" width="50%" | [[File:Owasp-defenders-small.png|link=]]<br />
|<br />
|-<br />
| align="center" valign="center" width="50%" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= Browse Online =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.<br />
<br />
[[Image:SAMM-Overview.png|720px]]<br />
<br />
===== Click on any badge to learn more =====<br />
<br />
{| cellpadding="1"<br />
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]<br />
|-<br />
| align="center" |'''Strategy & Metrics'''<br />
|{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM|padding=0}}<br />
|-<br />
| align="center" |'''Policy & Compliance'''<br />
|{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC|padding=0}}<br />
|-<br />
| align="center" |'''Education & Guidance'''<br />
|{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]<br />
|-<br />
| align="center" |'''Threat Assessment'''<br />
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}<br />
|-<br />
| align="center" |'''Security Requirements'''<br />
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}<br />
|-<br />
| align="center" |'''Secure Architecture'''<br />
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]<br />
|-<br />
| align="center" |'''Design Review'''<br />
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}<br />
|-<br />
| align="center" |'''Code Review'''<br />
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}<br />
|-<br />
| align="center" |'''Security Testing'''<br />
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]<br />
|-<br />
| align="center" |'''Vulnerability Management'''<br />
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}<br />
|-<br />
| align="center" |'''Environment Hardening'''<br />
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}<br />
|-<br />
| align="center" |'''Operational Enablement'''<br />
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}<br />
|-<br />
|}<br />
<br />
= Downloads =<br />
<br />
The latest work in progress can be found on Github: https://github.com/OWASP/samm<br />
<br />
Download SAMM v1.5<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] Zip file containing all the v1.5 files below;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] to perform SAMM assessments and create SAMM roadmaps;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Tool Box Example] to provide an example SAMM assessment;<br />
<br />
Download SAMM v1.1<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;<br />
<br />
Download OpenSAMM v1.0:<br />
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML<br />
* in [https://www.owasp.org/images/f/fd/SAMM-1.0-cn.pdf Chinese - PDF], not available as XML<br />
<br />
<br />
Available resources to apply SAMM:<br />
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]<br />
<br />
<br />
Trainings:<br />
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge<br />
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]<br />
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]<br />
<br />
<br />
Assessments:<br />
* SAMM v1.5 Toolbox<br />
** Download the new v1.5 Toolbox with the updated scoring model [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM v1.5 Toolbox]<br />
* SAMM v1.1 Toolbox<br />
** download the v1.1 toolbox, including the updated questions [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx here]<br />
* Assessment Interview Template by Nick Coblentz for SAMM V1.0<br />
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.<br />
* Roadmap Chart Template by Colin Watson for SAMM V1.0<br />
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.<br />
* Assessment Worksheet by Christian Frichot for SAMM V1.0<br />
** This is an easy-to-use [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.<br />
* Project Plan Template by Jim Weiler for SAMM V1.0<br />
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.<br />
<br />
<br />
Mappings:<br />
* BSIMM-6 mapping to SAMM activities:<br />
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]<br />
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]<br />
* BSIMM mapping to SAMM during the 2011 Summit:<br />
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).<br />
<br />
<br />
Tools:<br />
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]<br />
<br />
= Community =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}<br />
<br />
</div><br />
<br />
= Summit =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
Our last summit was in November 2018 in Minneapolis, check out the details [https://github.com/OWASP/samm/blob/master/Supporting%20Resources/v2.0/summit-201810-Minneapolis/Summit-outcomes.md here].<br />
<br />
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 >here<] !!<br />
<br />
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit<br />
<br />
<br />
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 >here<] !!<br />
<br />
Summit Notes:<br />
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit<br />
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]<br />
''"The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers."'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company<br />
<br />
Previous workshop Notes:<br />
<br />
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.<br />
<br />
This is also an excellent opportunity to exchange experiences with your peers.<br />
<br />
If you plan on attending http://appsec.eu be sure to get involved in the SAMM workshop (scheduled on Jun-23).<br />
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].<br />
<br />
Previous workshop notes:<br />
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].<br />
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].<br />
<br />
<br />
= Talks =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
Upcoming talks featuring SAMM are listed here:<br />
<br />
* OWASP DC - Software Assurance Maturity Model (SAMM) with Brian Glas! (2017-03-15)<br />
* OWASP NoVA - SAMM 1.5, what's changed and how it impacts you (2017-03-16)<br />
* InfoSec World - Software Assurance Maturity Model Evolutions (2017-04-03)<br />
<br />
past talks:<br />
<br />
* OWASP SAMM v1.5 Webinar - Brian Glas discussing the SAMM model and changes in v1.5 (watch - [https://www.youtube.com/watch?v=4pKdwRb8fTI youtube]) - 2017<br />
* OWASP 24/7 - Seba Deleersnyder discussing the upcoming SAMM Summit (listen - [https://soundcloud.com/owasp-podcast/seba-deleersnyder-discusses-samm-software-assurance-maturity-model-summit-in-dublin-ireland here]) - 2015<br />
* OWASP Germany Day 2014: Seba Deleersnyder: OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/f/fa/OpenSAMM_Best_Practices_Lessons_from_the_Trenches_-_Seba_Deleersnyder.pdf presentation]) - 2014<br />
* AppSecEU14: Seba Deleersnyder & Bart De Win: OpenSAMM Best Practices: Lessons from the Trenches OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/6/6f/OpenSAMM_-_AppSecEU_2014_-_Seba-Bart_v20140528.pptx presentation], see [https://www.youtube.com/watch?v=qcCgeBeBLUg video]) - 2014<br />
* AppSecEU13 - Hamburg: Seba Deleersnyder presenting a project update (download [https://www.owasp.org/images/3/32/OpenSAMM_-_Project_Status_-_Hamburg_2013.pdf presentation]) - 2013<br />
* OWASP Europe Tour 2013 - Geneva: Seba Deleersnyder presenting OpenSAMM and the renewed project (download [https://www.owasp.org/images/c/cd/OpenSAMM_-_OWASP_Tour_13_Talk_-_Seba.pptx presentation]) - 2013<br />
* AppSecEU11 - Athens: Colin Watson presenting SAMM Training (download [https://www.owasp.org/images/1/18/Owasp-training-samm-greece.pdf presentation]) - 2011<br />
* AppSecEU09: Pravir Chandra presenting OpenSAMM v1.0 (download [https://www.owasp.org/images/4/49/AppSecEU09_OpenSAMM-1.0.ppt presentation]) - 2009<br />
* Matt Bartoldus presentation on new SAMM project during OWASP London chapter (download [https://www.owasp.org/images/d/df/OpenSAMM.pdf presentation]) - 2009<br />
* Pravir Chandra - first presentation discussing the next generation to the CLASP Project- a complete working of the details into a Software Assurance Maturity Model (SAMM). (download [https://www.owasp.org/images/2/2e/OWASP_CLASP_SAMM.ppt presentation]) - 2009<br />
<br />
</div><br />
<br />
= News =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Latest News on SAMM<br />
* OWASP SAMM v2.0 workshop at the OWASP Project Summit June 2017<br />
* OWASP SAMM v1.5 Released!<br />
* SAMM Summit 2016 read the [https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit wrap-up here] <br />
* OWASP SAMM v1.1 Released! See the [http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release].<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
</div><br />
<br />
= Languages =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''SAMM v1.0 is available in the following languages:'''<br />
<br />
* English<br />
* Spanish<br />
* Japanese<br />
* Chinese<br />
<br />
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].<br />
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!<br />
<br />
</div><br />
<br />
= Roadmap =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Updated roadmap:<br />
Next 1.5 release, updated scoring:<br />
* Clarification of maturity levels (syntactic changes to keep the text consistent)<br />
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. <br />
* Show improvements with every activity introduced<br />
* Adapt for the new scoring method<br />
* Update questions for 4-tiers<br />
* Review and where necessary clarify current questions<br />
* Consider v1.1 remarks that were not withheld for the previous release<br />
Targeted completion date: February 28, 2017<br />
<br />
SAMM version 2.0<br />
* Core model changed<br />
* Visualisations + flavours for a few development methodologies<br />
* Update quickstart guide, TB, HTG. <br />
* Success metrics: How well does the model work: Linked to the benchmarking project.<br />
Timing: Workshops as part of OWASP Project Summit June 2017<br />
<br />
</div><br />
= Get Involved =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Involvement in the development of SAMM is actively encouraged!<br />
<br />
You do not have to be a security expert in order to contribute.<br />
<br />
Some of the ways you can help:<br />
<br />
==Feedback==<br />
<br />
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:<br />
* What do like?<br />
* What don't you like?<br />
* How can we make SAMM easier to use?<br />
* How could SAMM be improved? <br />
<br />
<br />
==Localization==<br />
<br />
Are you fluent in another language? Can you help translate SAMM into that language?<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!<br />
<br />
</div><br />
<br />
= Project Sponsors =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
SAMM is developed and maintained by a worldwide team of volunteers. We have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM.<br />
<br />
==SAMM Adopters==<br />
SAMM is the premier open source software assurance framework. You can find a list of [https://www.owasp.org/index.php/OpenSAMM_Adopters SAMM adopters] online.<br />
<br />
==Call for SAMM2 Sponsors==<br />
OWASP SAMM and the upcoming SAMM 2.0 release is the open source software security maturity model used to develop secure software for IT, application and software security technologists. <br />
<br />
We are seeking sponsors to support OWASP SAMM. All proceeds from the sponsorship support the mission of the OWASP Foundation and the further development of SAMM. Supporting the project drives the funding for research grants, SAMM hosting, tools, templates, documents, promotion, and more.<br />
<br />
By sponsoring SAMM, you not only support an important and flagship OWASP project, you will also get visibility during the next SAMM Summit (part of the [https://open-security-summit.org/ Open Security Summit 2019]) and recognition on the OWASP SAMM [https://owaspsamm.org/ web site] and the next release of SAMM (version 2.0).<br />
<br />
For more information: Contact [mailto:seba@owasp.org seba@owasp.org]<br />
<br />
==== Acknowledgements ====<br />
<br />
We would like to thank the following sponsors who donated funds to our project:<br />
<br />
[[File:Fortify blue 800px.png|250px|link=https://www.microfocus.com/en-us/solutions/application-security]] <br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
<br /><br />
{{OWASP Book|6888083}}<br />
<br /><br />
<br />
[[Category:OWASP Project|Zed Attack Proxy Project]]<br />
[[Category:OWASP_Tool]]<br />
[[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]]<br />
[[Category:OWASP_Download]]<br />
[[Category:Popular]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&diff=247770OWASP SAMM Project2019-02-24T15:00:04Z<p>Sdeleersnyder: </p>
<hr />
<div>= Main = <br />
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''OWASP SAMMv2 beta released for community review'''<br><br />
We are very proud to announce a new version of SAMM!<br><br />
Check it out on our new website: [https://owaspsamm.org/ https://owaspsamm.org/].<br><br />
Please, read our notes on how to provide [https://owaspsamm.org/v2.0b/feedback/ feedback].<br />
<br />
'''OWASP SAMM v1.5 available in the downloads section!'''<br><br />
We are now working on the Beta release of OWASP SAMMv2, our work in progress is available [https://owaspsamm.org online on our new web site]. <br><br />
<br />
'''Join our monthly calls'''<br />
* The monthly call is on each 2nd Wednesday of the month at 21h30 CEST / 3:30pm EST. <br><br />
* Please join our GoToMeeting: https://global.gotomeeting.com/join/262891661 <br><br />
* The call is open for everybody interested in SAMM or who wants to work on SAMM. <br><br />
<br />
'''Join us on the OWASP SAMM project Slack channel'''<br />
* Join our project slack channel on https://owasp.slack.com/messages/C0VF1EJGH <br />
* If you do not have an OWASP Slack workspace account yet, contact one of our project leaders to get an invite link.<br />
<br />
'''2018 OWASP SAMM Summit (4-8 JUNE 2018, London)'''<br />
* Join our 2018 OWASP SAMM Summit near London as part of the [https://open-security-summit.org/ Open Security Summit].<br><br />
* We will organize working sessions in a 5-day sprint to draft SAMM v2.0. <br />
* Register online [https://open-security-summit.org/tickets/ here]<br />
* Sponsor the SAMM2, more details [https://www.owasp.org/index.php/OWASP_SAMM_Project#tab=Project_Sponsors here]<br />
<br />
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:<br />
* '''Evaluate an organization’s existing software security practices'''<br />
* '''Build a balanced software security assurance program in well-defined iterations'''<br />
* '''Demonstrate concrete improvements to a security assurance program'''<br />
* '''Define and measure security-related activities throughout an organization'''<br />
<br />
<br />
<br />
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'', ('''Michael J. Craigue, Information Security & Compliance, Dell, Inc.''')<br />
<br />
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]<br />
<br />
{{Social Media Links}}<br />
<br />
| valign="top" style="padding-left:25px;width:200px;" |<br />
<br />
== Quick Download v1.5 ==<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Toolbox Example] <br><br />
[https://github.com/OWASP/samm/ OWASP SAMM on GitHub]<br />
<br />
== Quick Download v1.1.1 ==<br />
<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]<br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box]<br><br />
[https://github.com/OWASP/samm OWASP SAMM on GitHub]<br />
<br />
== News and Events ==<br />
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs<br />
<br />
== Change Log ==<br />
* OWASP SAMM v1.5 Released! ([http://www.prnewswire.com/news-releases/owasp-samm-v15-helps-organizations-improve-their-security-posture-300439237.html Press Release])<br />
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
== Email List ==<br />
<br />
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]<br />
<br />
== Project Leaders ==<br />
<br />
[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] <br /> [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win]<br />
<br />
== Related Projects ==<br />
<br />
*<br />
<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]<br />
| align="center" valign="center" width="50%" | [[File:Owasp-defenders-small.png|link=]]<br />
|<br />
|-<br />
| align="center" valign="center" width="50%" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= Browse Online =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.<br />
<br />
[[Image:SAMM-Overview.png|720px]]<br />
<br />
===== Click on any badge to learn more =====<br />
<br />
{| cellpadding="1"<br />
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]<br />
|-<br />
| align="center" |'''Strategy & Metrics'''<br />
|{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM|padding=0}}<br />
|-<br />
| align="center" |'''Policy & Compliance'''<br />
|{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC|padding=0}}<br />
|-<br />
| align="center" |'''Education & Guidance'''<br />
|{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]<br />
|-<br />
| align="center" |'''Threat Assessment'''<br />
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}<br />
|-<br />
| align="center" |'''Security Requirements'''<br />
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}<br />
|-<br />
| align="center" |'''Secure Architecture'''<br />
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]<br />
|-<br />
| align="center" |'''Design Review'''<br />
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}<br />
|-<br />
| align="center" |'''Code Review'''<br />
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}<br />
|-<br />
| align="center" |'''Security Testing'''<br />
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]<br />
|-<br />
| align="center" |'''Vulnerability Management'''<br />
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}<br />
|-<br />
| align="center" |'''Environment Hardening'''<br />
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}<br />
|-<br />
| align="center" |'''Operational Enablement'''<br />
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}<br />
|-<br />
|}<br />
<br />
= Downloads =<br />
<br />
The latest work in progress can be found on Github: https://github.com/OWASP/samm<br />
<br />
Download SAMM v1.5<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] Zip file containing all the v1.5 files below;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] to perform SAMM assessments and create SAMM roadmaps;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Tool Box Example] to provide an example SAMM assessment;<br />
<br />
Download SAMM v1.1<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;<br />
<br />
Download OpenSAMM v1.0:<br />
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML<br />
* in [https://www.owasp.org/images/f/fd/SAMM-1.0-cn.pdf Chinese - PDF], not available as XML<br />
<br />
<br />
Available resources to apply SAMM:<br />
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]<br />
<br />
<br />
Trainings:<br />
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge<br />
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]<br />
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]<br />
<br />
<br />
Assessments:<br />
* SAMM v1.5 Toolbox<br />
** Download the new v1.5 Toolbox with the updated scoring model [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM v1.5 Toolbox]<br />
* SAMM v1.1 Toolbox<br />
** download the v1.1 toolbox, including the updated questions [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx here]<br />
* Assessment Interview Template by Nick Coblentz for SAMM V1.0<br />
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.<br />
* Roadmap Chart Template by Colin Watson for SAMM V1.0<br />
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.<br />
* Assessment Worksheet by Christian Frichot for SAMM V1.0<br />
** This is an easy-to-use [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.<br />
* Project Plan Template by Jim Weiler for SAMM V1.0<br />
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.<br />
<br />
<br />
Mappings:<br />
* BSIMM-6 mapping to SAMM activities:<br />
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]<br />
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]<br />
* BSIMM mapping to SAMM during the 2011 Summit:<br />
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).<br />
<br />
<br />
Tools:<br />
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]<br />
<br />
= Community =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}<br />
<br />
</div><br />
<br />
= Summit =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 >here<] !!<br />
<br />
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit<br />
<br />
<br />
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 >here<] !!<br />
<br />
Summit Notes:<br />
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit<br />
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]<br />
''"The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers."'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company<br />
<br />
Previous workshop Notes:<br />
<br />
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.<br />
<br />
This is also an excellent opportunity to exchange experiences with your peers.<br />
<br />
If you plan on attending http://appsec.eu be sure to get involved in the SAMM workshop (scheduled on Jun-23).<br />
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].<br />
<br />
Previous workshop notes:<br />
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].<br />
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].<br />
<br />
<br />
= Talks =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
Upcoming talks featuring SAMM are listed here:<br />
<br />
* OWASP DC - Software Assurance Maturity Model (SAMM) with Brian Glas! (2017-03-15)<br />
* OWASP NoVA - SAMM 1.5, what's changed and how it impacts you (2017-03-16)<br />
* InfoSec World - Software Assurance Maturity Model Evolutions (2017-04-03)<br />
<br />
past talks:<br />
<br />
* OWASP SAMM v1.5 Webinar - Brian Glas discussing the SAMM model and changes in v1.5 (watch - [https://www.youtube.com/watch?v=4pKdwRb8fTI youtube]) - 2017<br />
* OWASP 24/7 - Seba Deleersnyder discussing the upcoming SAMM Summit (listen - [https://soundcloud.com/owasp-podcast/seba-deleersnyder-discusses-samm-software-assurance-maturity-model-summit-in-dublin-ireland here]) - 2015<br />
* OWASP Germany Day 2014: Seba Deleersnyder: OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/f/fa/OpenSAMM_Best_Practices_Lessons_from_the_Trenches_-_Seba_Deleersnyder.pdf presentation]) - 2014<br />
* AppSecEU14: Seba Deleersnyder & Bart De Win: OpenSAMM Best Practices: Lessons from the Trenches OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/6/6f/OpenSAMM_-_AppSecEU_2014_-_Seba-Bart_v20140528.pptx presentation], see [https://www.youtube.com/watch?v=qcCgeBeBLUg video]) - 2014<br />
* AppSecEU13 - Hamburg: Seba Deleersnyder presenting a project update (download [https://www.owasp.org/images/3/32/OpenSAMM_-_Project_Status_-_Hamburg_2013.pdf presentation]) - 2013<br />
* OWASP Europe Tour 2013 - Geneva: Seba Deleersnyder presenting OpenSAMM and the renewed project (download [https://www.owasp.org/images/c/cd/OpenSAMM_-_OWASP_Tour_13_Talk_-_Seba.pptx presentation]) - 2013<br />
* AppSecEU11 - Athens: Colin Watson presenting SAMM Training (download [https://www.owasp.org/images/1/18/Owasp-training-samm-greece.pdf presentation]) - 2011<br />
* AppSecEU09: Pravir Chandra presenting OpenSAMM v1.0 (download [https://www.owasp.org/images/4/49/AppSecEU09_OpenSAMM-1.0.ppt presentation]) - 2009<br />
* Matt Bartoldus presentation on new SAMM project during OWASP London chapter (download [https://www.owasp.org/images/d/df/OpenSAMM.pdf presentation]) - 2009<br />
* Pravir Chandra - first presentation discussing the next generation to the CLASP Project- a complete working of the details into a Software Assurance Maturity Model (SAMM). (download [https://www.owasp.org/images/2/2e/OWASP_CLASP_SAMM.ppt presentation]) - 2009<br />
<br />
</div><br />
<br />
= News =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Latest News on SAMM<br />
* OWASP SAMM v2.0 workshop at the OWASP Project Summit June 2017<br />
* OWASP SAMM v1.5 Released!<br />
* SAMM Summit 2016 read the [https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit wrap-up here] <br />
* OWASP SAMM v1.1 Released! See the [http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release].<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
</div><br />
<br />
= Languages =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''SAMM v1.0 is available in the following languages:'''<br />
<br />
* English<br />
* Spanish<br />
* Japanese<br />
* Chinese<br />
<br />
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].<br />
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!<br />
<br />
</div><br />
<br />
= Roadmap =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Updated roadmap:<br />
Next 1.5 release, updated scoring:<br />
* Clarification of maturity levels (syntactic changes to keep the text consistent)<br />
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. <br />
* Show improvements with every activity introduced<br />
* Adapt for the new scoring method<br />
* Update questions for 4-tiers<br />
* Review and where necessary clarify current questions<br />
* Consider v1.1 remarks that were not withheld for the previous release<br />
Targeted completion date: February 28, 2017<br />
<br />
SAMM version 2.0<br />
* Core model changed<br />
* Visualisations + flavours for a few development methodologies<br />
* Update quickstart guide, TB, HTG. <br />
* Success metrics: How well does the model work: Linked to the benchmarking project.<br />
Timing: Workshops as part of OWASP Project Summit June 2017<br />
<br />
</div><br />
= Get Involved =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Involvement in the development of SAMM is actively encouraged!<br />
<br />
You do not have to be a security expert in order to contribute.<br />
<br />
Some of the ways you can help:<br />
<br />
==Feedback==<br />
<br />
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:<br />
* What do like?<br />
* What don't you like?<br />
* How can we make SAMM easier to use?<br />
* How could SAMM be improved? <br />
<br />
<br />
==Localization==<br />
<br />
Are you fluent in another language? Can you help translate SAMM into that language?<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!<br />
<br />
</div><br />
<br />
= Project Sponsors =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
SAMM is developed and maintained by a worldwide team of volunteers. We have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM.<br />
<br />
==SAMM Adopters==<br />
SAMM is the premier open source software assurance framework. You can find a list of [https://www.owasp.org/index.php/OpenSAMM_Adopters SAMM adopters] online.<br />
<br />
==Call for SAMM2 Sponsors==<br />
OWASP SAMM and the upcoming SAMM 2.0 release is the open source software security maturity model used to develop secure software for IT, application and software security technologists. <br />
<br />
We are seeking sponsors to support OWASP SAMM. All proceeds from the sponsorship support the mission of the OWASP Foundation and the further development of SAMM. Supporting the project drives the funding for research grants, SAMM hosting, tools, templates, documents, promotion, and more.<br />
<br />
By sponsoring SAMM, you not only support an important and flagship OWASP project, you will also get visibility during the next SAMM Summit (part of the [https://open-security-summit.org/ Open Security Summit 2019]) and recognition on the OWASP SAMM [https://owaspsamm.org/ web site] and the next release of SAMM (version 2.0).<br />
<br />
For more information: Contact [mailto:seba@owasp.org seba@owasp.org]<br />
<br />
==== Acknowledgements ====<br />
<br />
We would like to thank the following sponsors who donated funds to our project:<br />
<br />
[[File:Fortify blue 800px.png|250px|link=https://www.microfocus.com/en-us/solutions/application-security]] <br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
<br /><br />
{{OWASP Book|6888083}}<br />
<br /><br />
<br />
[[Category:OWASP Project|Zed Attack Proxy Project]]<br />
[[Category:OWASP_Tool]]<br />
[[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]]<br />
[[Category:OWASP_Download]]<br />
[[Category:Popular]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&diff=247769OWASP SAMM Project2019-02-24T14:59:22Z<p>Sdeleersnyder: </p>
<hr />
<div>= Main = <br />
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''OWASP SAMMv2 beta released for community review'''<br />
We are very proud to announce a new version of SAMM!<br><br />
Check it out on our new website: [https://owaspsamm.org/ https://owaspsamm.org/].<br><br />
Please, read our notes on how to provide [https://owaspsamm.org/v2.0b/feedback/ feedback].<br />
<br />
'''OWASP SAMM v1.5 available in the downloads section!'''<br />
<br />
We are now working on the Beta release of OWASP SAMMv2, our work in progress is available [https://owaspsamm.org online on our new web site]. <br><br />
<br />
'''Join our monthly calls'''<br />
* The monthly call is on each 2nd Wednesday of the month at 21h30 CEST / 3:30pm EST. <br><br />
* Please join our GoToMeeting: https://global.gotomeeting.com/join/262891661 <br><br />
* The call is open for everybody interested in SAMM or who wants to work on SAMM. <br><br />
<br />
'''Join us on the OWASP SAMM project Slack channel'''<br />
* Join our project slack channel on https://owasp.slack.com/messages/C0VF1EJGH <br />
* If you do not have an OWASP Slack workspace account yet, contact one of our project leaders to get an invite link.<br />
<br />
'''2018 OWASP SAMM Summit (4-8 JUNE 2018, London)'''<br />
* Join our 2018 OWASP SAMM Summit near London as part of the [https://open-security-summit.org/ Open Security Summit].<br><br />
* We will organize working sessions in a 5-day sprint to draft SAMM v2.0. <br />
* Register online [https://open-security-summit.org/tickets/ here]<br />
* Sponsor the SAMM2, more details [https://www.owasp.org/index.php/OWASP_SAMM_Project#tab=Project_Sponsors here]<br />
<br />
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:<br />
* '''Evaluate an organization’s existing software security practices'''<br />
* '''Build a balanced software security assurance program in well-defined iterations'''<br />
* '''Demonstrate concrete improvements to a security assurance program'''<br />
* '''Define and measure security-related activities throughout an organization'''<br />
<br />
<br />
<br />
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'', ('''Michael J. Craigue, Information Security & Compliance, Dell, Inc.''')<br />
<br />
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]<br />
<br />
{{Social Media Links}}<br />
<br />
| valign="top" style="padding-left:25px;width:200px;" |<br />
<br />
== Quick Download v1.5 ==<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Toolbox Example] <br><br />
[https://github.com/OWASP/samm/ OWASP SAMM on GitHub]<br />
<br />
== Quick Download v1.1.1 ==<br />
<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]<br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box]<br><br />
[https://github.com/OWASP/samm OWASP SAMM on GitHub]<br />
<br />
== News and Events ==<br />
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs<br />
<br />
== Change Log ==<br />
* OWASP SAMM v1.5 Released! ([http://www.prnewswire.com/news-releases/owasp-samm-v15-helps-organizations-improve-their-security-posture-300439237.html Press Release])<br />
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
== Email List ==<br />
<br />
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]<br />
<br />
== Project Leaders ==<br />
<br />
[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] <br /> [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win]<br />
<br />
== Related Projects ==<br />
<br />
*<br />
<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]<br />
| align="center" valign="center" width="50%" | [[File:Owasp-defenders-small.png|link=]]<br />
|<br />
|-<br />
| align="center" valign="center" width="50%" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= Browse Online =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.<br />
<br />
[[Image:SAMM-Overview.png|720px]]<br />
<br />
===== Click on any badge to learn more =====<br />
<br />
{| cellpadding="1"<br />
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]<br />
|-<br />
| align="center" |'''Strategy & Metrics'''<br />
|{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM|padding=0}}<br />
|-<br />
| align="center" |'''Policy & Compliance'''<br />
|{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC|padding=0}}<br />
|-<br />
| align="center" |'''Education & Guidance'''<br />
|{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]<br />
|-<br />
| align="center" |'''Threat Assessment'''<br />
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}<br />
|-<br />
| align="center" |'''Security Requirements'''<br />
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}<br />
|-<br />
| align="center" |'''Secure Architecture'''<br />
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]<br />
|-<br />
| align="center" |'''Design Review'''<br />
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}<br />
|-<br />
| align="center" |'''Code Review'''<br />
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}<br />
|-<br />
| align="center" |'''Security Testing'''<br />
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]<br />
|-<br />
| align="center" |'''Vulnerability Management'''<br />
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}<br />
|-<br />
| align="center" |'''Environment Hardening'''<br />
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}<br />
|-<br />
| align="center" |'''Operational Enablement'''<br />
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}<br />
|-<br />
|}<br />
<br />
= Downloads =<br />
<br />
The latest work in progress can be found on Github: https://github.com/OWASP/samm<br />
<br />
Download SAMM v1.5<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] Zip file containing all the v1.5 files below;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] to perform SAMM assessments and create SAMM roadmaps;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Tool Box Example] to provide an example SAMM assessment;<br />
<br />
Download SAMM v1.1<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;<br />
<br />
Download OpenSAMM v1.0:<br />
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML<br />
* in [https://www.owasp.org/images/f/fd/SAMM-1.0-cn.pdf Chinese - PDF], not available as XML<br />
<br />
<br />
Available resources to apply SAMM:<br />
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]<br />
<br />
<br />
Trainings:<br />
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge<br />
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]<br />
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]<br />
<br />
<br />
Assessments:<br />
* SAMM v1.5 Toolbox<br />
** Download the new v1.5 Toolbox with the updated scoring model [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM v1.5 Toolbox]<br />
* SAMM v1.1 Toolbox<br />
** download the v1.1 toolbox, including the updated questions [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx here]<br />
* Assessment Interview Template by Nick Coblentz for SAMM V1.0<br />
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.<br />
* Roadmap Chart Template by Colin Watson for SAMM V1.0<br />
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.<br />
* Assessment Worksheet by Christian Frichot for SAMM V1.0<br />
** This is an easy-to-use [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.<br />
* Project Plan Template by Jim Weiler for SAMM V1.0<br />
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.<br />
<br />
<br />
Mappings:<br />
* BSIMM-6 mapping to SAMM activities:<br />
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]<br />
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]<br />
* BSIMM mapping to SAMM during the 2011 Summit:<br />
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).<br />
<br />
<br />
Tools:<br />
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]<br />
<br />
= Community =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}<br />
<br />
</div><br />
<br />
= Summit =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 >here<] !!<br />
<br />
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit<br />
<br />
<br />
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 >here<] !!<br />
<br />
Summit Notes:<br />
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit<br />
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]<br />
''"The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers."'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company<br />
<br />
Previous workshop Notes:<br />
<br />
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.<br />
<br />
This is also an excellent opportunity to exchange experiences with your peers.<br />
<br />
If you plan on attending http://appsec.eu be sure to get involved in the SAMM workshop (scheduled on Jun-23).<br />
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].<br />
<br />
Previous workshop notes:<br />
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].<br />
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].<br />
<br />
<br />
= Talks =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
Upcoming talks featuring SAMM are listed here:<br />
<br />
* OWASP DC - Software Assurance Maturity Model (SAMM) with Brian Glas! (2017-03-15)<br />
* OWASP NoVA - SAMM 1.5, what's changed and how it impacts you (2017-03-16)<br />
* InfoSec World - Software Assurance Maturity Model Evolutions (2017-04-03)<br />
<br />
past talks:<br />
<br />
* OWASP SAMM v1.5 Webinar - Brian Glas discussing the SAMM model and changes in v1.5 (watch - [https://www.youtube.com/watch?v=4pKdwRb8fTI youtube]) - 2017<br />
* OWASP 24/7 - Seba Deleersnyder discussing the upcoming SAMM Summit (listen - [https://soundcloud.com/owasp-podcast/seba-deleersnyder-discusses-samm-software-assurance-maturity-model-summit-in-dublin-ireland here]) - 2015<br />
* OWASP Germany Day 2014: Seba Deleersnyder: OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/f/fa/OpenSAMM_Best_Practices_Lessons_from_the_Trenches_-_Seba_Deleersnyder.pdf presentation]) - 2014<br />
* AppSecEU14: Seba Deleersnyder & Bart De Win: OpenSAMM Best Practices: Lessons from the Trenches OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/6/6f/OpenSAMM_-_AppSecEU_2014_-_Seba-Bart_v20140528.pptx presentation], see [https://www.youtube.com/watch?v=qcCgeBeBLUg video]) - 2014<br />
* AppSecEU13 - Hamburg: Seba Deleersnyder presenting a project update (download [https://www.owasp.org/images/3/32/OpenSAMM_-_Project_Status_-_Hamburg_2013.pdf presentation]) - 2013<br />
* OWASP Europe Tour 2013 - Geneva: Seba Deleersnyder presenting OpenSAMM and the renewed project (download [https://www.owasp.org/images/c/cd/OpenSAMM_-_OWASP_Tour_13_Talk_-_Seba.pptx presentation]) - 2013<br />
* AppSecEU11 - Athens: Colin Watson presenting SAMM Training (download [https://www.owasp.org/images/1/18/Owasp-training-samm-greece.pdf presentation]) - 2011<br />
* AppSecEU09: Pravir Chandra presenting OpenSAMM v1.0 (download [https://www.owasp.org/images/4/49/AppSecEU09_OpenSAMM-1.0.ppt presentation]) - 2009<br />
* Matt Bartoldus presentation on new SAMM project during OWASP London chapter (download [https://www.owasp.org/images/d/df/OpenSAMM.pdf presentation]) - 2009<br />
* Pravir Chandra - first presentation discussing the next generation to the CLASP Project- a complete working of the details into a Software Assurance Maturity Model (SAMM). (download [https://www.owasp.org/images/2/2e/OWASP_CLASP_SAMM.ppt presentation]) - 2009<br />
<br />
</div><br />
<br />
= News =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Latest News on SAMM<br />
* OWASP SAMM v2.0 workshop at the OWASP Project Summit June 2017<br />
* OWASP SAMM v1.5 Released!<br />
* SAMM Summit 2016 read the [https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit wrap-up here] <br />
* OWASP SAMM v1.1 Released! See the [http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release].<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
</div><br />
<br />
= Languages =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''SAMM v1.0 is available in the following languages:'''<br />
<br />
* English<br />
* Spanish<br />
* Japanese<br />
* Chinese<br />
<br />
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].<br />
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!<br />
<br />
</div><br />
<br />
= Roadmap =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Updated roadmap:<br />
Next 1.5 release, updated scoring:<br />
* Clarification of maturity levels (syntactic changes to keep the text consistent)<br />
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. <br />
* Show improvements with every activity introduced<br />
* Adapt for the new scoring method<br />
* Update questions for 4-tiers<br />
* Review and where necessary clarify current questions<br />
* Consider v1.1 remarks that were not withheld for the previous release<br />
Targeted completion date: February 28, 2017<br />
<br />
SAMM version 2.0<br />
* Core model changed<br />
* Visualisations + flavours for a few development methodologies<br />
* Update quickstart guide, TB, HTG. <br />
* Success metrics: How well does the model work: Linked to the benchmarking project.<br />
Timing: Workshops as part of OWASP Project Summit June 2017<br />
<br />
</div><br />
= Get Involved =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Involvement in the development of SAMM is actively encouraged!<br />
<br />
You do not have to be a security expert in order to contribute.<br />
<br />
Some of the ways you can help:<br />
<br />
==Feedback==<br />
<br />
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:<br />
* What do like?<br />
* What don't you like?<br />
* How can we make SAMM easier to use?<br />
* How could SAMM be improved? <br />
<br />
<br />
==Localization==<br />
<br />
Are you fluent in another language? Can you help translate SAMM into that language?<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!<br />
<br />
</div><br />
<br />
= Project Sponsors =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
SAMM is developed and maintained by a worldwide team of volunteers. We have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM.<br />
<br />
==SAMM Adopters==<br />
SAMM is the premier open source software assurance framework. You can find a list of [https://www.owasp.org/index.php/OpenSAMM_Adopters SAMM adopters] online.<br />
<br />
==Call for SAMM2 Sponsors==<br />
OWASP SAMM and the upcoming SAMM 2.0 release is the open source software security maturity model used to develop secure software for IT, application and software security technologists. <br />
<br />
We are seeking sponsors to support OWASP SAMM. All proceeds from the sponsorship support the mission of the OWASP Foundation and the further development of SAMM. Supporting the project drives the funding for research grants, SAMM hosting, tools, templates, documents, promotion, and more.<br />
<br />
By sponsoring SAMM, you not only support an important and flagship OWASP project, you will also get visibility during the next SAMM Summit (part of the [https://open-security-summit.org/ Open Security Summit 2019]) and recognition on the OWASP SAMM [https://owaspsamm.org/ web site] and the next release of SAMM (version 2.0).<br />
<br />
For more information: Contact [mailto:seba@owasp.org seba@owasp.org]<br />
<br />
==== Acknowledgements ====<br />
<br />
We would like to thank the following sponsors who donated funds to our project:<br />
<br />
[[File:Fortify blue 800px.png|250px|link=https://www.microfocus.com/en-us/solutions/application-security]] <br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
<br /><br />
{{OWASP Book|6888083}}<br />
<br /><br />
<br />
[[Category:OWASP Project|Zed Attack Proxy Project]]<br />
[[Category:OWASP_Tool]]<br />
[[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]]<br />
[[Category:OWASP_Download]]<br />
[[Category:Popular]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&diff=247768OWASP SAMM Project2019-02-24T14:51:29Z<p>Sdeleersnyder: </p>
<hr />
<div>= Main = <br />
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''OWASP SAMM v1.5 available in the downloads section!'''<br />
<br />
We are now working on the Beta release of OWASP SAMMv2, our work in progress is available [https://owaspsamm.org online on our new web site]. <br><br />
<br />
'''Join our monthly calls'''<br />
* The monthly call is on each 2nd Wednesday of the month at 21h30 CEST / 3:30pm EST. <br><br />
* Please join our GoToMeeting: https://global.gotomeeting.com/join/262891661 <br><br />
* The call is open for everybody interested in SAMM or who wants to work on SAMM. <br><br />
<br />
'''Join us on the OWASP SAMM project Slack channel'''<br />
* Join our project slack channel on https://owasp.slack.com/messages/C0VF1EJGH <br />
* If you do not have an OWASP Slack workspace account yet, contact one of our project leaders to get an invite link.<br />
<br />
'''2018 OWASP SAMM Summit (4-8 JUNE 2018, London)'''<br />
* Join our 2018 OWASP SAMM Summit near London as part of the [https://open-security-summit.org/ Open Security Summit].<br><br />
* We will organize working sessions in a 5-day sprint to draft SAMM v2.0. <br />
* Register online [https://open-security-summit.org/tickets/ here]<br />
* Sponsor the SAMM2, more details [https://www.owasp.org/index.php/OWASP_SAMM_Project#tab=Project_Sponsors here]<br />
<br />
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:<br />
* '''Evaluate an organization’s existing software security practices'''<br />
* '''Build a balanced software security assurance program in well-defined iterations'''<br />
* '''Demonstrate concrete improvements to a security assurance program'''<br />
* '''Define and measure security-related activities throughout an organization'''<br />
<br />
<br />
<br />
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'', ('''Michael J. Craigue, Information Security & Compliance, Dell, Inc.''')<br />
<br />
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]<br />
<br />
{{Social Media Links}}<br />
<br />
| valign="top" style="padding-left:25px;width:200px;" |<br />
<br />
== Quick Download v1.5 ==<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Toolbox Example] <br><br />
[https://github.com/OWASP/samm/ OWASP SAMM on GitHub]<br />
<br />
== Quick Download v1.1.1 ==<br />
<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]<br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box]<br><br />
[https://github.com/OWASP/samm OWASP SAMM on GitHub]<br />
<br />
== News and Events ==<br />
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs<br />
<br />
== Change Log ==<br />
* OWASP SAMM v1.5 Released! ([http://www.prnewswire.com/news-releases/owasp-samm-v15-helps-organizations-improve-their-security-posture-300439237.html Press Release])<br />
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
== Email List ==<br />
<br />
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]<br />
<br />
== Project Leaders ==<br />
<br />
[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] <br /> [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win]<br />
<br />
== Related Projects ==<br />
<br />
*<br />
<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]<br />
| align="center" valign="center" width="50%" | [[File:Owasp-defenders-small.png|link=]]<br />
|<br />
|-<br />
| align="center" valign="center" width="50%" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= Browse Online =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.<br />
<br />
[[Image:SAMM-Overview.png|720px]]<br />
<br />
===== Click on any badge to learn more =====<br />
<br />
{| cellpadding="1"<br />
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]<br />
|-<br />
| align="center" |'''Strategy & Metrics'''<br />
|{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM|padding=0}}<br />
|-<br />
| align="center" |'''Policy & Compliance'''<br />
|{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC|padding=0}}<br />
|-<br />
| align="center" |'''Education & Guidance'''<br />
|{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]<br />
|-<br />
| align="center" |'''Threat Assessment'''<br />
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}<br />
|-<br />
| align="center" |'''Security Requirements'''<br />
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}<br />
|-<br />
| align="center" |'''Secure Architecture'''<br />
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]<br />
|-<br />
| align="center" |'''Design Review'''<br />
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}<br />
|-<br />
| align="center" |'''Code Review'''<br />
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}<br />
|-<br />
| align="center" |'''Security Testing'''<br />
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]<br />
|-<br />
| align="center" |'''Vulnerability Management'''<br />
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}<br />
|-<br />
| align="center" |'''Environment Hardening'''<br />
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}<br />
|-<br />
| align="center" |'''Operational Enablement'''<br />
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}<br />
|-<br />
|}<br />
<br />
= Downloads =<br />
<br />
The latest work in progress can be found on Github: https://github.com/OWASP/samm<br />
<br />
Download SAMM v1.5<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] Zip file containing all the v1.5 files below;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] to perform SAMM assessments and create SAMM roadmaps;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Tool Box Example] to provide an example SAMM assessment;<br />
<br />
Download SAMM v1.1<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;<br />
<br />
Download OpenSAMM v1.0:<br />
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML<br />
* in [https://www.owasp.org/images/f/fd/SAMM-1.0-cn.pdf Chinese - PDF], not available as XML<br />
<br />
<br />
Available resources to apply SAMM:<br />
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]<br />
<br />
<br />
Trainings:<br />
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge<br />
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]<br />
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]<br />
<br />
<br />
Assessments:<br />
* SAMM v1.5 Toolbox<br />
** Download the new v1.5 Toolbox with the updated scoring model [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM v1.5 Toolbox]<br />
* SAMM v1.1 Toolbox<br />
** download the v1.1 toolbox, including the updated questions [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx here]<br />
* Assessment Interview Template by Nick Coblentz for SAMM V1.0<br />
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.<br />
* Roadmap Chart Template by Colin Watson for SAMM V1.0<br />
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.<br />
* Assessment Worksheet by Christian Frichot for SAMM V1.0<br />
** This is an easy-to-use [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.<br />
* Project Plan Template by Jim Weiler for SAMM V1.0<br />
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.<br />
<br />
<br />
Mappings:<br />
* BSIMM-6 mapping to SAMM activities:<br />
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]<br />
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]<br />
* BSIMM mapping to SAMM during the 2011 Summit:<br />
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).<br />
<br />
<br />
Tools:<br />
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]<br />
<br />
= Community =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}<br />
<br />
</div><br />
<br />
= Summit =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 >here<] !!<br />
<br />
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit<br />
<br />
<br />
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 >here<] !!<br />
<br />
Summit Notes:<br />
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit<br />
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]<br />
''"The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers."'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company<br />
<br />
Previous workshop Notes:<br />
<br />
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.<br />
<br />
This is also an excellent opportunity to exchange experiences with your peers.<br />
<br />
If you plan on attending http://appsec.eu be sure to get involved in the SAMM workshop (scheduled on Jun-23).<br />
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].<br />
<br />
Previous workshop notes:<br />
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].<br />
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].<br />
<br />
<br />
= Talks =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
Upcoming talks featuring SAMM are listed here:<br />
<br />
* OWASP DC - Software Assurance Maturity Model (SAMM) with Brian Glas! (2017-03-15)<br />
* OWASP NoVA - SAMM 1.5, what's changed and how it impacts you (2017-03-16)<br />
* InfoSec World - Software Assurance Maturity Model Evolutions (2017-04-03)<br />
<br />
past talks:<br />
<br />
* OWASP SAMM v1.5 Webinar - Brian Glas discussing the SAMM model and changes in v1.5 (watch - [https://www.youtube.com/watch?v=4pKdwRb8fTI youtube]) - 2017<br />
* OWASP 24/7 - Seba Deleersnyder discussing the upcoming SAMM Summit (listen - [https://soundcloud.com/owasp-podcast/seba-deleersnyder-discusses-samm-software-assurance-maturity-model-summit-in-dublin-ireland here]) - 2015<br />
* OWASP Germany Day 2014: Seba Deleersnyder: OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/f/fa/OpenSAMM_Best_Practices_Lessons_from_the_Trenches_-_Seba_Deleersnyder.pdf presentation]) - 2014<br />
* AppSecEU14: Seba Deleersnyder & Bart De Win: OpenSAMM Best Practices: Lessons from the Trenches OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/6/6f/OpenSAMM_-_AppSecEU_2014_-_Seba-Bart_v20140528.pptx presentation], see [https://www.youtube.com/watch?v=qcCgeBeBLUg video]) - 2014<br />
* AppSecEU13 - Hamburg: Seba Deleersnyder presenting a project update (download [https://www.owasp.org/images/3/32/OpenSAMM_-_Project_Status_-_Hamburg_2013.pdf presentation]) - 2013<br />
* OWASP Europe Tour 2013 - Geneva: Seba Deleersnyder presenting OpenSAMM and the renewed project (download [https://www.owasp.org/images/c/cd/OpenSAMM_-_OWASP_Tour_13_Talk_-_Seba.pptx presentation]) - 2013<br />
* AppSecEU11 - Athens: Colin Watson presenting SAMM Training (download [https://www.owasp.org/images/1/18/Owasp-training-samm-greece.pdf presentation]) - 2011<br />
* AppSecEU09: Pravir Chandra presenting OpenSAMM v1.0 (download [https://www.owasp.org/images/4/49/AppSecEU09_OpenSAMM-1.0.ppt presentation]) - 2009<br />
* Matt Bartoldus presentation on new SAMM project during OWASP London chapter (download [https://www.owasp.org/images/d/df/OpenSAMM.pdf presentation]) - 2009<br />
* Pravir Chandra - first presentation discussing the next generation to the CLASP Project- a complete working of the details into a Software Assurance Maturity Model (SAMM). (download [https://www.owasp.org/images/2/2e/OWASP_CLASP_SAMM.ppt presentation]) - 2009<br />
<br />
</div><br />
<br />
= News =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Latest News on SAMM<br />
* OWASP SAMM v2.0 workshop at the OWASP Project Summit June 2017<br />
* OWASP SAMM v1.5 Released!<br />
* SAMM Summit 2016 read the [https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit wrap-up here] <br />
* OWASP SAMM v1.1 Released! See the [http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release].<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
</div><br />
<br />
= Languages =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''SAMM v1.0 is available in the following languages:'''<br />
<br />
* English<br />
* Spanish<br />
* Japanese<br />
* Chinese<br />
<br />
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].<br />
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!<br />
<br />
</div><br />
<br />
= Roadmap =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Updated roadmap:<br />
Next 1.5 release, updated scoring:<br />
* Clarification of maturity levels (syntactic changes to keep the text consistent)<br />
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. <br />
* Show improvements with every activity introduced<br />
* Adapt for the new scoring method<br />
* Update questions for 4-tiers<br />
* Review and where necessary clarify current questions<br />
* Consider v1.1 remarks that were not withheld for the previous release<br />
Targeted completion date: February 28, 2017<br />
<br />
SAMM version 2.0<br />
* Core model changed<br />
* Visualisations + flavours for a few development methodologies<br />
* Update quickstart guide, TB, HTG. <br />
* Success metrics: How well does the model work: Linked to the benchmarking project.<br />
Timing: Workshops as part of OWASP Project Summit June 2017<br />
<br />
</div><br />
= Get Involved =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Involvement in the development of SAMM is actively encouraged!<br />
<br />
You do not have to be a security expert in order to contribute.<br />
<br />
Some of the ways you can help:<br />
<br />
==Feedback==<br />
<br />
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:<br />
* What do like?<br />
* What don't you like?<br />
* How can we make SAMM easier to use?<br />
* How could SAMM be improved? <br />
<br />
<br />
==Localization==<br />
<br />
Are you fluent in another language? Can you help translate SAMM into that language?<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!<br />
<br />
</div><br />
<br />
= Project Sponsors =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
SAMM is developed and maintained by a worldwide team of volunteers. We have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM.<br />
<br />
==SAMM Adopters==<br />
SAMM is the premier open source software assurance framework. You can find a list of [https://www.owasp.org/index.php/OpenSAMM_Adopters SAMM adopters] online.<br />
<br />
==Call for SAMM2 Sponsors==<br />
OWASP SAMM and the upcoming SAMM 2.0 release is the open source software security maturity model used to develop secure software for IT, application and software security technologists. <br />
<br />
We are seeking sponsors to support OWASP SAMM. All proceeds from the sponsorship support the mission of the OWASP Foundation and the further development of SAMM. Supporting the project drives the funding for research grants, SAMM hosting, tools, templates, documents, promotion, and more.<br />
<br />
By sponsoring SAMM, you not only support an important and flagship OWASP project, you will also get visibility during the next SAMM Summit (part of the [https://open-security-summit.org/ Open Security Summit 2019]) and recognition on the OWASP SAMM [https://owaspsamm.org/ web site] and the next release of SAMM (version 2.0).<br />
<br />
For more information: Contact [mailto:seba@owasp.org seba@owasp.org]<br />
<br />
==== Acknowledgements ====<br />
<br />
We would like to thank the following sponsors who donated funds to our project:<br />
<br />
[[File:Fortify blue 800px.png|250px|link=https://www.microfocus.com/en-us/solutions/application-security]] <br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
<br /><br />
{{OWASP Book|6888083}}<br />
<br /><br />
<br />
[[Category:OWASP Project|Zed Attack Proxy Project]]<br />
[[Category:OWASP_Tool]]<br />
[[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]]<br />
[[Category:OWASP_Download]]<br />
[[Category:Popular]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&diff=247767OWASP SAMM Project2019-02-24T14:49:16Z<p>Sdeleersnyder: </p>
<hr />
<div>= Main = <br />
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''OWASP SAMM v1.5 available in the downloads section!'''<br />
<br />
We are now working on the Beta release of OWASP SAMMv2, our work in progress is available [https://owaspsamm.org online on our new web site]. <br><br />
<br />
'''Join our monthly calls'''<br />
* The monthly call is on each 2nd Wednesday of the month at 21h30 CEST / 3:30pm EST. <br><br />
* Please join our GoToMeeting: https://global.gotomeeting.com/join/262891661 <br><br />
* The call is open for everybody interested in SAMM or who wants to work on SAMM. <br><br />
<br />
'''Join us on the OWASP SAMM project Slack channel'''<br />
* Join our project slack channel on https://owasp.slack.com/messages/C0VF1EJGH <br />
* If you do not have an OWASP Slack workspace account yet, contact one of our project leaders to get an invite link.<br />
<br />
'''2018 OWASP SAMM Summit (4-8 JUNE 2018, London)'''<br />
* Join our 2018 OWASP SAMM Summit near London as part of the [https://open-security-summit.org/ Open Security Summit].<br><br />
* We will organize working sessions in a 5-day sprint to draft SAMM v2.0. <br />
* Register online [https://open-security-summit.org/tickets/ here]<br />
* Sponsor the SAMM2, more details [https://www.owasp.org/index.php/OWASP_SAMM_Project#tab=Project_Sponsors here]<br />
<br />
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:<br />
* '''Evaluate an organization’s existing software security practices'''<br />
* '''Build a balanced software security assurance program in well-defined iterations'''<br />
* '''Demonstrate concrete improvements to a security assurance program'''<br />
* '''Define and measure security-related activities throughout an organization'''<br />
<br />
<br />
<br />
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'', ('''Michael J. Craigue, Information Security & Compliance, Dell, Inc.''')<br />
<br />
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]<br />
<br />
{{Social Media Links}}<br />
<br />
| valign="top" style="padding-left:25px;width:200px;" |<br />
<br />
== Quick Download v1.5 ==<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Toolbox Example] <br><br />
[https://github.com/OWASP/samm/ OWASP SAMM on GitHub]<br />
<br />
== Quick Download v1.1.1 ==<br />
<br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]<br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] <br><br />
[https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box]<br><br />
[https://github.com/OWASP/samm OWASP SAMM on GitHub]<br />
<br />
== News and Events ==<br />
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs<br />
<br />
== Change Log ==<br />
* OWASP SAMM v1.5 Released! ([http://www.prnewswire.com/news-releases/owasp-samm-v15-helps-organizations-improve-their-security-posture-300439237.html Press Release])<br />
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
== Email List ==<br />
<br />
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]<br />
<br />
== Project Leaders ==<br />
<br />
[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] <br /> [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win]<br />
<br />
== Related Projects ==<br />
<br />
*<br />
<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]<br />
| align="center" valign="center" width="50%" | [[File:Owasp-defenders-small.png|link=]]<br />
|<br />
|-<br />
| align="center" valign="center" width="50%" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= Browse Online =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.<br />
<br />
[[Image:SAMM-Overview.png|720px]]<br />
<br />
===== Click on any badge to learn more =====<br />
<br />
{| cellpadding="1"<br />
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]<br />
|-<br />
| align="center" |'''Strategy & Metrics'''<br />
|{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM|padding=0}}<br />
|-<br />
| align="center" |'''Policy & Compliance'''<br />
|{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC|padding=0}}<br />
|-<br />
| align="center" |'''Education & Guidance'''<br />
|{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]<br />
|-<br />
| align="center" |'''Threat Assessment'''<br />
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}<br />
|-<br />
| align="center" |'''Security Requirements'''<br />
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}<br />
|-<br />
| align="center" |'''Secure Architecture'''<br />
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]<br />
|-<br />
| align="center" |'''Design Review'''<br />
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}<br />
|-<br />
| align="center" |'''Code Review'''<br />
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}<br />
|-<br />
| align="center" |'''Security Testing'''<br />
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]<br />
|-<br />
| align="center" |'''Vulnerability Management'''<br />
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}<br />
|-<br />
| align="center" |'''Environment Hardening'''<br />
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}<br />
|-<br />
| align="center" |'''Operational Enablement'''<br />
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}<br />
|-<br />
|}<br />
<br />
= Downloads =<br />
<br />
The latest work in progress can be found on Github: https://github.com/OWASP/samm<br />
<br />
Download SAMM v1.5<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] Zip file containing all the v1.5 files below;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] to perform SAMM assessments and create SAMM roadmaps;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Tool Box Example] to provide an example SAMM assessment;<br />
<br />
Download SAMM v1.1<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;<br />
<br />
Download OpenSAMM v1.0:<br />
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML<br />
* in [https://www.owasp.org/images/f/fd/SAMM-1.0-cn.pdf Chinese - PDF], not available as XML<br />
<br />
<br />
Available resources to apply SAMM:<br />
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]<br />
<br />
<br />
Trainings:<br />
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge<br />
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]<br />
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]<br />
<br />
<br />
Assessments:<br />
* SAMM v1.5 Toolbox<br />
** Download the new v1.5 Toolbox with the updated scoring model [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM v1.5 Toolbox]<br />
* SAMM v1.1 Toolbox<br />
** download the v1.1 toolbox, including the updated questions [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx here]<br />
* Assessment Interview Template by Nick Coblentz for SAMM V1.0<br />
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.<br />
* Roadmap Chart Template by Colin Watson for SAMM V1.0<br />
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.<br />
* Assessment Worksheet by Christian Frichot for SAMM V1.0<br />
** This is an easy-to-use [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.<br />
* Project Plan Template by Jim Weiler for SAMM V1.0<br />
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.<br />
<br />
<br />
Mappings:<br />
* BSIMM-6 mapping to SAMM activities:<br />
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]<br />
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]<br />
* BSIMM mapping to SAMM during the 2011 Summit:<br />
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).<br />
<br />
<br />
Tools:<br />
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]<br />
<br />
= Community =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}<br />
<br />
</div><br />
<br />
= Summit =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 >here<] !!<br />
<br />
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit<br />
<br />
<br />
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 >here<] !!<br />
<br />
Summit Notes:<br />
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit<br />
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]<br />
''"The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers."'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company<br />
<br />
Previous workshop Notes:<br />
<br />
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.<br />
<br />
This is also an excellent opportunity to exchange experiences with your peers.<br />
<br />
If you plan on attending http://appsec.eu be sure to get involved in the SAMM workshop (scheduled on Jun-23).<br />
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].<br />
<br />
Previous workshop notes:<br />
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].<br />
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].<br />
<br />
<br />
= Talks =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
Upcoming talks featuring SAMM are listed here:<br />
<br />
* OWASP DC - Software Assurance Maturity Model (SAMM) with Brian Glas! (2017-03-15)<br />
* OWASP NoVA - SAMM 1.5, what's changed and how it impacts you (2017-03-16)<br />
* InfoSec World - Software Assurance Maturity Model Evolutions (2017-04-03)<br />
<br />
past talks:<br />
<br />
* OWASP SAMM v1.5 Webinar - Brian Glas discussing the SAMM model and changes in v1.5 (watch - [https://www.youtube.com/watch?v=4pKdwRb8fTI youtube]) - 2017<br />
* OWASP 24/7 - Seba Deleersnyder discussing the upcoming SAMM Summit (listen - [https://soundcloud.com/owasp-podcast/seba-deleersnyder-discusses-samm-software-assurance-maturity-model-summit-in-dublin-ireland here]) - 2015<br />
* OWASP Germany Day 2014: Seba Deleersnyder: OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/f/fa/OpenSAMM_Best_Practices_Lessons_from_the_Trenches_-_Seba_Deleersnyder.pdf presentation]) - 2014<br />
* AppSecEU14: Seba Deleersnyder & Bart De Win: OpenSAMM Best Practices: Lessons from the Trenches OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/6/6f/OpenSAMM_-_AppSecEU_2014_-_Seba-Bart_v20140528.pptx presentation], see [https://www.youtube.com/watch?v=qcCgeBeBLUg video]) - 2014<br />
* AppSecEU13 - Hamburg: Seba Deleersnyder presenting a project update (download [https://www.owasp.org/images/3/32/OpenSAMM_-_Project_Status_-_Hamburg_2013.pdf presentation]) - 2013<br />
* OWASP Europe Tour 2013 - Geneva: Seba Deleersnyder presenting OpenSAMM and the renewed project (download [https://www.owasp.org/images/c/cd/OpenSAMM_-_OWASP_Tour_13_Talk_-_Seba.pptx presentation]) - 2013<br />
* AppSecEU11 - Athens: Colin Watson presenting SAMM Training (download [https://www.owasp.org/images/1/18/Owasp-training-samm-greece.pdf presentation]) - 2011<br />
* AppSecEU09: Pravir Chandra presenting OpenSAMM v1.0 (download [https://www.owasp.org/images/4/49/AppSecEU09_OpenSAMM-1.0.ppt presentation]) - 2009<br />
* Matt Bartoldus presentation on new SAMM project during OWASP London chapter (download [https://www.owasp.org/images/d/df/OpenSAMM.pdf presentation]) - 2009<br />
* Pravir Chandra - first presentation discussing the next generation to the CLASP Project- a complete working of the details into a Software Assurance Maturity Model (SAMM). (download [https://www.owasp.org/images/2/2e/OWASP_CLASP_SAMM.ppt presentation]) - 2009<br />
<br />
</div><br />
<br />
= News =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Latest News on SAMM<br />
* OWASP SAMM v2.0 workshop at the OWASP Project Summit June 2017<br />
* OWASP SAMM v1.5 Released!<br />
* SAMM Summit 2016 read the [https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit wrap-up here] <br />
* OWASP SAMM v1.1 Released! See the [http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release].<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
</div><br />
<br />
= Languages =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''SAMM v1.0 is available in the following languages:'''<br />
<br />
* English<br />
* Spanish<br />
* Japanese<br />
* Chinese<br />
<br />
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].<br />
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!<br />
<br />
</div><br />
<br />
= Roadmap =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Updated roadmap:<br />
Next 1.5 release, updated scoring:<br />
* Clarification of maturity levels (syntactic changes to keep the text consistent)<br />
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. <br />
* Show improvements with every activity introduced<br />
* Adapt for the new scoring method<br />
* Update questions for 4-tiers<br />
* Review and where necessary clarify current questions<br />
* Consider v1.1 remarks that were not withheld for the previous release<br />
Targeted completion date: February 28, 2017<br />
<br />
SAMM version 2.0<br />
* Core model changed<br />
* Visualisations + flavours for a few development methodologies<br />
* Update quickstart guide, TB, HTG. <br />
* Success metrics: How well does the model work: Linked to the benchmarking project.<br />
Timing: Workshops as part of OWASP Project Summit June 2017<br />
<br />
</div><br />
= Get Involved =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Involvement in the development of SAMM is actively encouraged!<br />
<br />
You do not have to be a security expert in order to contribute.<br />
<br />
Some of the ways you can help:<br />
<br />
==Feedback==<br />
<br />
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:<br />
* What do like?<br />
* What don't you like?<br />
* How can we make SAMM easier to use?<br />
* How could SAMM be improved? <br />
<br />
<br />
==Localization==<br />
<br />
Are you fluent in another language? Can you help translate SAMM into that language?<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!<br />
<br />
</div><br />
<br />
= Project Sponsors =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
SAMM is developed and maintained by a worldwide team of volunteers. We have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM.<br />
<br />
==SAMM Adopters==<br />
SAMM is the premier open source software assurance framework. You can find a list of [https://www.owasp.org/index.php/OpenSAMM_Adopters SAMM adopters] online.<br />
<br />
==Call for SAMM2 Sponsors==<br />
OWASP SAMM and the upcoming SAMM 2.0 release is the open source software security maturity model used to develop secure software for IT, application and software security technologists. <br />
<br />
We are seeking sponsors to support OWASP SAMM. All proceeds from the sponsorship support the mission of the OWASP Foundation and the further development of SAMM. Supporting the project drives the funding for research grants, SAMM hosting, tools, templates, documents, promotion, and more.<br />
<br />
By sponsoring SAMM, you not only support an important and flagship OWASP project, you will also get visibility during the next SAMM Summit (part of the OWASP Summit 2018) and recognition on the OWASP SAMM project web site and the next release of SAMM (version 2.0).<br />
<br />
For more information: Contact [mailto:seba@owasp.org seba@owasp.org]<br />
<br />
==== Acknowledgements ====<br />
<br />
<br />
<br />
We would like to thank the following sponsors who donated funds to our project:<br />
<br />
[[File:Fortify blue 800px.png|250px|link=https://www.microfocus.com/en-us/solutions/application-security]] <br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
<br /><br />
{{OWASP Book|6888083}}<br />
<br /><br />
<br />
[[Category:OWASP Project|Zed Attack Proxy Project]]<br />
[[Category:OWASP_Tool]]<br />
[[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]]<br />
[[Category:OWASP_Download]]<br />
[[Category:Popular]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:Fortify_blue_800px.png&diff=247766File:Fortify blue 800px.png2019-02-24T14:48:00Z<p>Sdeleersnyder: </p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=Belgium_Events_2019&diff=247765Belgium Events 20192019-02-24T13:31:08Z<p>Sdeleersnyder: /* Agenda */</p>
<hr />
<div><noinclude><br />
These are the 2019 events of the [[Belgium|OWASP Belgium Chapter]]. <!-- Copy the source from [[Belgium Chapter Meeting Template]] to start a new chapter meeting event! --><br />
<br />
Previous year: [[Belgium Events 2018|2018]].<br />
<!-- Next year: [[Belgium Events 2020|2020]].--><br />
</noinclude><br />
== 20 February 2019 Meeting ==<br />
<br />
<!--<br />
Burn-down list for customization:<br />
- Replace LINK_PRESENTER_TALK_1<br />
- Replace LINK_PRESENTER_TALK_2<br />
- Replace OWASP_UPDATE_PRESENTATION, uncomment the link and delete the placeholder (italicized title)<br />
- Replace SLIDES_TALK_1, uncomment the links and delete the placeholders (italicized title and "not yet available" in the talk's subsection)<br />
- Replace SLIDES_TALK_2, uncomment the links and delete the placeholders (italicized title and "not yet available" in the talk's subsection)<br />
- Provide coverage photos / links to blog posts etc.<br />
--><br />
<br />
=== Where ===<br />
<br />
* Host: [https://distrinet.cs.kuleuven.be DistriNet Research Group (KU Leuven)] (Both speakers are faculty of the [https://www.secappdev.org/ Secure Application Development] course held in Leuven from 2019-02-18 to 2018-02-22.)<br />
<br />
* Address ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap map], [https://distrinet.cs.kuleuven.be/about/route/ directions]):<br />
Department of Computer Science (foyer at ground floor)<br />
Celestijnenlaan 200 A<br />
3001 Heverlee<br />
<br />
=== Agenda ===<br />
<br />
*18h15 - 19h00: Welcome & sandwiches<br />
*19h00 - 19h10: ''[https://www.owasp.org/images/6/69/Owasp_Belgium_update_2019-02-20_v1.pdf OWASP Update]'' by Sebastien Deleersnyder (OWASP)<br />
*19h10 - 20h00: '[https://www.owasp.org/images/5/54/CSP_Martin_Johns_OWASP_BE.pdf 'CSP in the age of Script Gadgets]'' by Prof. Martin Johns (TU Braunschweig)<br />
*20h00 - 20h10: Break<br />
*20h10 - 21h00: ''Zero to DevSecOps - security in a DevOps world'' (part [https://www.owasp.org/images/7/7d/Zero-to-DevSecOps-OWASP-Meetup-02-19-19_-_part_0.pdf 1], [https://www.owasp.org/images/3/3a/Zero-to-DevSecOps-OWASP-Meetup-02-19-19_-_part_1.pdf 2], [https://www.owasp.org/images/0/0c/Zero-to-DevSecOps-OWASP-Meetup-02-19-19_-_part_2.pdf 3]) by Jimmy Mesta (CTO, Manicode Security)<br />
<br />
=== Program ===<br />
<br />
==== CSP in the age of Script Gadgets ====<br />
<br />
* Speaker: <!--[LINK_PRESENTER_TALK_1 Prof. Martin Johns]--> Prof. Martin Johns (TU Braunschweig)<br />
* Presentation: <!--[[:File:SLIDES_TALK_1]]--> not yet available<br />
<br />
''Abstract''<br />
<br />
Content Security Policy (CSP) was first introduced in 2012. It should have been a silver-bullet defense against various injection attacks, including the rampant Cross-Site Scripting vulnerabilities. Unfortunately, modern development practices and legacy code bases proved to be substantial obstacles. New versions of CSP were released to address usability and compatibility for developers. Unfortunately, researchers discovered many bypasses and vulnerabilities in real-world CSP policies. The latest problem is known as script gadgets, where data is turned into code by legitimate functionality.<br />
<br />
In this session, we will take a look at the problems you might encounter when deploying CSP. We start at CSP level 1 and work towards the latest level 3 version. We discuss CSP's features, potential bypasses, and pitfalls to avoid. In the end, you will have gained the knowledge to deploy a secure and effective CSP policy.<br />
<br />
''Speaker Bio''<br />
<br />
Martin Johns is a full professor at the TU Braunschweig.<br />
<br />
==== Zero to DevSecOps - security in a DevOps world ====<br />
<br />
* Speaker: <!--[LINK_PRESENTER_TALK_2 Jimmy Mesta]--> Jimmy Mesta (CTO, Manicode Security)<br />
* Presentation: <!--[[:File:SLIDES_TALK_2]]--> not yet available<br />
<br />
''Abstract''<br />
<br />
The way that software is being deployed is undergoing a massive transformation. As a result, security teams are at a point where they must adapt or be left in the dust. Traditional application security used to be heavyweight and human-driven. Tasks are more often than not mostly manual efforts. Time-consuming security testing often breaks down in an automated world. Dynamic vulnerability scanning and manual code reviews are incompatible with a world where code changes are automatically being pushed to production hundreds of times per day. <br />
<br />
This talk will share lessons learned from helping teams of all sizes and maturity levels with their transformation to a DevSecOps model where security goes from being a blocker to an enabler. Specifically, we will cover some of the tools and processes you can start using right now. These tools allow you to start adding real value to your organization through enhanced visibility, vulnerability discovery, and feedback loops. It is time to adapt and embrace a new era of security.<br />
<br />
''Speaker Bio''<br />
<br />
Jimmy Mesta is CTO at Manicode Security. He is a DevSecOps, Mobile, and Kubernetes Secure Coding Instructor.<br />
<br />
=== Registration ===<br />
<br />
Registration is via EventBrite: https://owasp-belgium-2019-02-20.eventbrite.com.<br />
<br />
=== Coverage ===<br />
<br />
n/a</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:CSP_Martin_Johns_OWASP_BE.pdf&diff=247764File:CSP Martin Johns OWASP BE.pdf2019-02-24T13:30:47Z<p>Sdeleersnyder: </p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:Owasp_Belgium_update_2019-02-20_v1.pdf&diff=247763File:Owasp Belgium update 2019-02-20 v1.pdf2019-02-24T13:29:33Z<p>Sdeleersnyder: </p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:Zero-to-DevSecOps-OWASP-Meetup-02-19-19_-_part_2.pdf&diff=247762File:Zero-to-DevSecOps-OWASP-Meetup-02-19-19 - part 2.pdf2019-02-24T13:27:22Z<p>Sdeleersnyder: </p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:Zero-to-DevSecOps-OWASP-Meetup-02-19-19_-_part_1.pdf&diff=247761File:Zero-to-DevSecOps-OWASP-Meetup-02-19-19 - part 1.pdf2019-02-24T13:26:48Z<p>Sdeleersnyder: </p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:Zero-to-DevSecOps-OWASP-Meetup-02-19-19_-_part_0.pdf&diff=247760File:Zero-to-DevSecOps-OWASP-Meetup-02-19-19 - part 0.pdf2019-02-24T13:24:07Z<p>Sdeleersnyder: </p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&diff=245167OWASP SAMM Project2018-11-15T07:30:46Z<p>Sdeleersnyder: </p>
<hr />
<div>= Main = <br />
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''OWASP SAMM v1.5 available in the downloads section!'''<br />
<br />
We are now working on the Beta release of OWASP SAMMv2, our work in progress is available [https://owaspsamm.org online on our new web site]. <br><br />
<br />
'''Join our monthly calls'''<br />
* The monthly call is on each 2nd Wednesday of the month at 21h30 CEST / 3:30pm EST. <br><br />
* Please join our GoToMeeting: https://global.gotomeeting.com/join/262891661 <br><br />
* The call is open for everybody interested in SAMM or who wants to work on SAMM. <br><br />
<br />
'''Join us on the OWASP SAMM project Slack channel'''<br />
* Join our project slack channel on https://owasp.slack.com/messages/C0VF1EJGH <br />
* If you do not have an OWASP Slack workspace account yet, contact one of our project leaders to get an invite link.<br />
<br />
'''2018 OWASP SAMM Summit (4-8 JUNE 2018, London)'''<br />
* Join our 2018 OWASP SAMM Summit near London as part of the [https://open-security-summit.org/ Open Security Summit].<br><br />
* We will organize working sessions in a 5-day sprint to draft SAMM v2.0. <br />
* Register online [https://open-security-summit.org/tickets/ here]<br />
* Sponsor the SAMM2, more details [https://www.owasp.org/index.php/OWASP_SAMM_Project#tab=Project_Sponsors here]<br />
<br />
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:<br />
* '''Evaluate an organization’s existing software security practices'''<br />
* '''Build a balanced software security assurance program in well-defined iterations'''<br />
* '''Demonstrate concrete improvements to a security assurance program'''<br />
* '''Define and measure security-related activities throughout an organization'''<br />
<br />
<br />
<br />
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'', ('''Michael J. Craigue, Information Security & Compliance, Dell, Inc.''')<br />
<br />
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]<br />
<br />
{{Social Media Links}}<br />
<br />
| valign="top" style="padding-left:25px;width:200px;" |<br />
<br />
== Quick Download v1.5 ==<br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick Start Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Toolbox Example] <br><br />
[https://github.com/OWASP/samm/ OWASP SAMM on GitHub]<br />
<br />
== Quick Download v1.1.1 ==<br />
<br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]<br><br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box]<br><br />
[https://github.com/OWASP/samm OWASP SAMM on GitHub]<br />
<br />
== News and Events ==<br />
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs<br />
<br />
== Change Log ==<br />
* OWASP SAMM v1.5 Released! ([http://www.prnewswire.com/news-releases/owasp-samm-v15-helps-organizations-improve-their-security-posture-300439237.html Press Release])<br />
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
== Email List ==<br />
<br />
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]<br />
<br />
== Project Leaders ==<br />
<br />
[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] <br /> [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win]<br />
<br />
== Related Projects ==<br />
<br />
*<br />
<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]<br />
| align="center" valign="center" width="50%" | [[File:Owasp-defenders-small.png|link=]]<br />
|<br />
|-<br />
| align="center" valign="center" width="50%" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= Browse Online =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.<br />
<br />
[[Image:SAMM-Overview.png|720px]]<br />
<br />
===== Click on any badge to learn more =====<br />
<br />
{| cellpadding="1"<br />
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]<br />
|-<br />
| align="center" |'''Strategy & Metrics'''<br />
|{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM|padding=0}}<br />
|-<br />
| align="center" |'''Policy & Compliance'''<br />
|{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC|padding=0}}<br />
|-<br />
| align="center" |'''Education & Guidance'''<br />
|{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]<br />
|-<br />
| align="center" |'''Threat Assessment'''<br />
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}<br />
|-<br />
| align="center" |'''Security Requirements'''<br />
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}<br />
|-<br />
| align="center" |'''Secure Architecture'''<br />
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]<br />
|-<br />
| align="center" |'''Design Review'''<br />
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}<br />
|-<br />
| align="center" |'''Code Review'''<br />
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}<br />
|-<br />
| align="center" |'''Security Testing'''<br />
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]<br />
|-<br />
| align="center" |'''Vulnerability Management'''<br />
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}<br />
|-<br />
| align="center" |'''Environment Hardening'''<br />
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}<br />
|-<br />
| align="center" |'''Operational Enablement'''<br />
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}<br />
|-<br />
|}<br />
<br />
= Downloads =<br />
<br />
The latest work in progress can be found on Github: https://github.com/OWASP/samm<br />
<br />
Download SAMM v1.5<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] Zip file containing all the v1.5 files below;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] to perform SAMM assessments and create SAMM roadmaps;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Tool Box Example] to provide an example SAMM assessment;<br />
<br />
Download SAMM v1.1<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;<br />
<br />
Download OpenSAMM v1.0:<br />
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML<br />
* in [https://www.owasp.org/images/f/fd/SAMM-1.0-cn.pdf Chinese - PDF], not available as XML<br />
<br />
<br />
Available resources to apply SAMM:<br />
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]<br />
<br />
<br />
Trainings:<br />
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge<br />
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]<br />
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]<br />
<br />
<br />
Assessments:<br />
* SAMM v1.5 Toolbox<br />
** Download the new v1.5 Toolbox with the updated scoring model [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM v1.5 Toolbox]<br />
* SAMM v1.1 Toolbox<br />
** download the v1.1 toolbox, including the updated questions [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx here]<br />
* Assessment Interview Template by Nick Coblentz for SAMM V1.0<br />
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.<br />
* Roadmap Chart Template by Colin Watson for SAMM V1.0<br />
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.<br />
* Assessment Worksheet by Christian Frichot for SAMM V1.0<br />
** This is an easy-to-use [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.<br />
* Project Plan Template by Jim Weiler for SAMM V1.0<br />
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.<br />
<br />
<br />
Mappings:<br />
* BSIMM-6 mapping to SAMM activities:<br />
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]<br />
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]<br />
* BSIMM mapping to SAMM during the 2011 Summit:<br />
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).<br />
<br />
<br />
Tools:<br />
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]<br />
<br />
= Community =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}<br />
<br />
</div><br />
<br />
= Summit =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 >here<] !!<br />
<br />
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit<br />
<br />
<br />
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 >here<] !!<br />
<br />
Summit Notes:<br />
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit<br />
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]<br />
''"The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers."'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company<br />
<br />
Previous workshop Notes:<br />
<br />
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.<br />
<br />
This is also an excellent opportunity to exchange experiences with your peers.<br />
<br />
If you plan on attending http://appsec.eu be sure to get involved in the SAMM workshop (scheduled on Jun-23).<br />
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].<br />
<br />
Previous workshop notes:<br />
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].<br />
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].<br />
<br />
<br />
= Talks =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
Upcoming talks featuring SAMM are listed here:<br />
<br />
* OWASP DC - Software Assurance Maturity Model (SAMM) with Brian Glas! (2017-03-15)<br />
* OWASP NoVA - SAMM 1.5, what's changed and how it impacts you (2017-03-16)<br />
* InfoSec World - Software Assurance Maturity Model Evolutions (2017-04-03)<br />
<br />
past talks:<br />
<br />
* OWASP SAMM v1.5 Webinar - Brian Glas discussing the SAMM model and changes in v1.5 (watch - [https://www.youtube.com/watch?v=4pKdwRb8fTI youtube]) - 2017<br />
* OWASP 24/7 - Seba Deleersnyder discussing the upcoming SAMM Summit (listen - [https://soundcloud.com/owasp-podcast/seba-deleersnyder-discusses-samm-software-assurance-maturity-model-summit-in-dublin-ireland here]) - 2015<br />
* OWASP Germany Day 2014: Seba Deleersnyder: OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/f/fa/OpenSAMM_Best_Practices_Lessons_from_the_Trenches_-_Seba_Deleersnyder.pdf presentation]) - 2014<br />
* AppSecEU14: Seba Deleersnyder & Bart De Win: OpenSAMM Best Practices: Lessons from the Trenches OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/6/6f/OpenSAMM_-_AppSecEU_2014_-_Seba-Bart_v20140528.pptx presentation], see [https://www.youtube.com/watch?v=qcCgeBeBLUg video]) - 2014<br />
* AppSecEU13 - Hamburg: Seba Deleersnyder presenting a project update (download [https://www.owasp.org/images/3/32/OpenSAMM_-_Project_Status_-_Hamburg_2013.pdf presentation]) - 2013<br />
* OWASP Europe Tour 2013 - Geneva: Seba Deleersnyder presenting OpenSAMM and the renewed project (download [https://www.owasp.org/images/c/cd/OpenSAMM_-_OWASP_Tour_13_Talk_-_Seba.pptx presentation]) - 2013<br />
* AppSecEU11 - Athens: Colin Watson presenting SAMM Training (download [https://www.owasp.org/images/1/18/Owasp-training-samm-greece.pdf presentation]) - 2011<br />
* AppSecEU09: Pravir Chandra presenting OpenSAMM v1.0 (download [https://www.owasp.org/images/4/49/AppSecEU09_OpenSAMM-1.0.ppt presentation]) - 2009<br />
* Matt Bartoldus presentation on new SAMM project during OWASP London chapter (download [https://www.owasp.org/images/d/df/OpenSAMM.pdf presentation]) - 2009<br />
* Pravir Chandra - first presentation discussing the next generation to the CLASP Project- a complete working of the details into a Software Assurance Maturity Model (SAMM). (download [https://www.owasp.org/images/2/2e/OWASP_CLASP_SAMM.ppt presentation]) - 2009<br />
<br />
</div><br />
<br />
= News =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Latest News on SAMM<br />
* OWASP SAMM v2.0 workshop at the OWASP Project Summit June 2017<br />
* OWASP SAMM v1.5 Released!<br />
* SAMM Summit 2016 read the [https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit wrap-up here] <br />
* OWASP SAMM v1.1 Released! See the [http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release].<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
</div><br />
<br />
= Languages =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''SAMM v1.0 is available in the following languages:'''<br />
<br />
* English<br />
* Spanish<br />
* Japanese<br />
* Chinese<br />
<br />
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].<br />
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!<br />
<br />
</div><br />
<br />
= Roadmap =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Updated roadmap:<br />
Next 1.5 release, updated scoring:<br />
* Clarification of maturity levels (syntactic changes to keep the text consistent)<br />
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. <br />
* Show improvements with every activity introduced<br />
* Adapt for the new scoring method<br />
* Update questions for 4-tiers<br />
* Review and where necessary clarify current questions<br />
* Consider v1.1 remarks that were not withheld for the previous release<br />
Targeted completion date: February 28, 2017<br />
<br />
SAMM version 2.0<br />
* Core model changed<br />
* Visualisations + flavours for a few development methodologies<br />
* Update quickstart guide, TB, HTG. <br />
* Success metrics: How well does the model work: Linked to the benchmarking project.<br />
Timing: Workshops as part of OWASP Project Summit June 2017<br />
<br />
</div><br />
= Get Involved =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Involvement in the development of SAMM is actively encouraged!<br />
<br />
You do not have to be a security expert in order to contribute.<br />
<br />
Some of the ways you can help:<br />
<br />
==Feedback==<br />
<br />
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:<br />
* What do like?<br />
* What don't you like?<br />
* How can we make SAMM easier to use?<br />
* How could SAMM be improved? <br />
<br />
<br />
==Localization==<br />
<br />
Are you fluent in another language? Can you help translate SAMM into that language?<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!<br />
<br />
</div><br />
<br />
= Project Sponsors =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
SAMM is developed and maintained by a worldwide team of volunteers. We have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM.<br />
<br />
==SAMM Adopters==<br />
SAMM is the premier open source software assurance framework. You can find a list of [https://www.owasp.org/index.php/OpenSAMM_Adopters SAMM adopters] online.<br />
<br />
==Call for SAMM2 Sponsors==<br />
OWASP SAMM and the upcoming SAMM 2.0 release is the open source software security maturity model used to develop secure software for IT, application and software security technologists. <br />
<br />
We are seeking sponsors to support OWASP SAMM. All proceeds from the sponsorship support the mission of the OWASP Foundation and the further development of SAMM. Supporting the project drives the funding for research grants, SAMM hosting, tools, templates, documents, promotion, and more.<br />
<br />
By sponsoring SAMM, you not only support an important and flagship OWASP project, you will also get visibility during the next SAMM Summit (part of the OWASP Summit 2018) and recognition on the OWASP SAMM project web site and the next release of SAMM (version 2.0).<br />
<br />
For more information: Contact [mailto:seba@owasp.org seba@owasp.org]<br />
<br />
==== Acknowledgements ====<br />
<br />
<br />
<br />
We would like to thank the following sponsors who donated funds to our project:<br />
<br />
[[File:OWASP-NoVA-Chapter-Logo.PNG|250px|link=https://www.owasp.org/index.php/Virginia]]<br />
[[File:Belgium_Chapter.PNG|250px|link=https://www.owasp.org/index.php/Belgium]]<br />
[[File:London_Chapter.PNG|250px|link=https://www.owasp.org/index.php/London]]<br />
<br />
[[File:Aspectsecurity.png|250px|link=http://www.aspectsecurity.com]]<br />
[[File:Astech_Consulting_logo.png|250px|link=http://www.astechconsulting.com/]] <br />
[[File:Denim_Group_logo.jpg|250px|link=http://www.denimgroup.com/]] <br />
[[File:Gotham_Digital_Science_logo.jpg|250px|link=http://www.gdssecurity.com/]] <br />
<br />
{{MemberLinksv2|link=http://www.hpenterprisesecurity.com|logo=HP_Blue_RGB_150_SM.png|size=300px90px}} <br />
[[File:NetSPI_logo.png|250px|link=http://www.netspi.com/]] <br />
[[Image:PwC_logo_4colourprint_(2)_Resized_good_one.jpg|150px|link=http://www.pwc.com]]<br />
[[File:SI_Logo_Stacked_Application_Security.jpg|250px|link=http://www.securityinnovation.com/]] <br />
[[File:LogoToreon.jpg|250px|link=http://www.toreon.com]] <br />
[[File:Veracode-samm.png|250px|link=http://www.veracode.com]] <br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
<br /><br />
{{OWASP Book|6888083}}<br />
<br /><br />
<br />
[[Category:OWASP Project|Zed Attack Proxy Project]]<br />
[[Category:OWASP_Tool]]<br />
[[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]]<br />
[[Category:OWASP_Download]]<br />
[[Category:Popular]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_BeNeLux-Days_2018&diff=244415OWASP BeNeLux-Days 20182018-10-22T14:29:17Z<p>Sdeleersnyder: </p>
<hr />
<div><center>[[Image:OBNL18 Banner v2.png]]</center><br />
<br />
<br><!-- Header --><br />
<br />
<br />
<!-- First tab --><br />
= Information =<br />
<!-- <br />
== Keynote Speaker ==<br />
<br />
{{#switchtablink:Conference Day|<p><br />
* TBD<br />
}}<br />
--><br />
== Confirmed Conference Speakers ==<br />
<br />
{{#switchtablink:Conference_Day|<p><br />
* David Scrobonia<br />
* Niels Tanis<br />
* Jeroen Willemsen<br />
* Björn Kimminich<br />
* Ralph Moonen<br />
* Jo Van Bulck<br />
* Lennert Wouters<br />
* Nick Drage<br />
}}<br />
<br />
== Confirmed Trainers ==<br />
<br />
{{#switchtablink:Training Day|<p><br />
* Andrew Martin<br />
* David Scrobonia<br />
* Jeroen Beckers - Stephanie Vanroelen<br />
}}<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
<br />
Registration is not open yet. Please come back in a few days.<br />
<!--<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
--><br />
<br />
== The OWASP BeNeLux Program Committee ==<br />
<br />
*Sebastien Deleersnyder / Lieven Desmet / David Mathy / Thomas Herlea / Stella Dineva / Adolfo Solero / Bart De Win, OWASP Belgium<br />
*Martin Knobloch / Joren Poll / Edwin Goweling, OWASP Netherlands<br />
*OWASP Luxembourg<br />
<br />
== Tweet! ==<br />
<br />
Event tag is [http://twitter.com/#search?q=%23owaspbnl17 #owaspbnl18]<br />
<br />
== Donate to OWASP BeNeLux ==<br />
<br />
[https://co.clickandpledge.com/?wid=72689 Donate]<br />
<br />
<!-- Second tab --><br />
= Registration =<br />
<br />
== OWASP BeNeLux conference and training days are free, but registration is required! ==<br />
Registration is not open yet. Please come back in a few days.<br />
<!--<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
--><br />
<br />
<!--<br />
[https://owasp-benelux-day-2018.eventbrite.com Register now!]<br />
--><br />
<br />
'''To support the OWASP organisation, consider to become a member, it's only US$50! Check out the [[Membership]] page to find out more.''' <br />
<br />
<!-- Third tab --><br />
<br />
= Venue =<br />
<br />
== Address ==<br />
<br />
Venue:<br />
<br />
'''Congres- en Erfgoedcentrum Lamot'''<br />
Van Beethovenstraat 8-10<br />
2800 Mechelen<br />
Belgium<br />
<br />
[https://goo.gl/maps/gZ9icR178w52 Google map]<br />
<br /><br />
[[File:Mechelen-Lamot.jpg|350px|Lamot conference center]]<br />
[[File:Mechelen-lamot-center-auditorium.jpg|350px|Auditorium]]<br /><br />
<br />
Parking:<br /><br />
[[File:Parking lots around Lamot Conference center Mechelen.png|500px|Parking facilities]]<br /><br />
[https://goo.gl/maps/Q5TD7hoTuUu Find your parking on Google Maps]<br />
<br />
=== How to reach the venue? ===<br />
<br />
==== Public transport ====<br />
<br />
You can reach the Mechelen's train station from Antwerpen or Brussels.<br />
The Lamot conference center is 10 min away by bus (line 1).<br />
<br />
Or you can choose to walk for 15 min (1.2 km).<br />
<br />
<br />
==== By car ====<br />
<br />
===== From Brussels: =====<br />
Follow the E19 Brussels / Antwerpen and take the exit 10. <br> Follow the N1 until the R12 (take a left) and turn to the right at the "Brusselpoort" into the Hoogstraat to reach one of the parkings.<br />
<br />
===== From Antwerpen: =====<br />
Follow the E19 Brussels / Antwerpen and take the exit 9. <br> Follow the N16 until the R12 (take a right) and turn to the left at the "Brusselpoort" into the Hoogstraat to reach one of the parkings. <br />
<br />
<br />
=== Hotels Nearby ===<br />
[https://www.google.com/maps/d/viewer?mid=1eYMYmwXKuAsTilKgpAtyYtfMA7A&ll=51.02648134397288%2C4.47819800000002&z=15 Hotels around the Lamot conference center]<br />
<br />
<!-- Fourth tab --><br />
= Training Day =<br />
<br />
'''Training Day is November 29th'''<br />
== Agenda==<br />
<br />
{| class="wikitable"<br />
! Time !! Description !! Training 1 !! Training 2 !! Training 3<br />
|-<br />
| 08h30 - 9h30<br />
| colspan="5" style="text-align: center; background: grey; color: white;" | ''Registration''<br />
|-<br />
| 09h30 - 11h00 || Training<br />
| rowspan="7" style="width:100px;" | [[#TRAINING_1 | Kubernetes security]] by Andrew Martin<br />
| rowspan="7" style="width:100px;" | [[#TRAINING_2 | OWASP Zap Training]] by David Scrobonia<br />
| rowspan="7" style="width:100px;" | [[#TRAINING_3 | Android security workshop]] by Jeroen Beckers & Stephanie Vanroelen<br />
|-<br />
| 11h00 - 11h30 || ''Coffee Break''<br />
|-<br />
| 11h30 - 13h00 || Training<br />
|-<br />
| 13h00 - 14h00 || ''Lunch''<br />
|-<br />
| 14h00 - 15h30 || Training<br />
|-<br />
| 15h30 - 16h00 || ''Coffee Break''<br />
|-<br />
| 16h00 - 17h30 || Training<br />
|}<br />
<br />
<font color="red">Choose the most appropriate training as they will be hosted at the same time.</font><br />
<br />
== Trainings ==<br />
<br />
=== <span id="TRAINING_1">Training 1 - Kubernetes security by Andrew Martin</span> ===<br />
<br />
==== Abstract ====<br />
<br />
===== Course Description =====<br />
The course guides attendees through Linux container security in general, and progresses to advanced Kubernetes cluster security. It emphasises pragmatic threat modelling and risk assessment based on an understanding of the tools and primitives available, rather than dogmatic dos and don’ts.<br />
<br />
===== Course Outline =====<br />
* How to attack containerised workloads<br />
* Enhanced container security<br />
* How to attack Kubernetes<br />
* Interactive production cluster hacking<br />
* Hardening Kubernetes<br />
* Locking down applications<br />
* Security tooling and vendor landscape<br />
<br />
===== Who Should Attend =====<br />
This course is suitable for intermediate to advanced Kubernetes users who want to strengthen their security understanding. It is particularly beneficial for those operating Kubernetes in a high-compliance domain, or for established security professionals looking to update their skills for the cloud native world.<br />
<br />
==== Bio ====<br />
<br />
Andrew has a strong test-first engineering ethos gained architecting and deploying high-traffic web applications. Proficient in systems development, testing, and maintenance, he is comfortable profiling and securing every tier of a bare metal or cloud native application, and has battle-hardened experience delivering containerised solutions to enterprise clients. He is a co-founder at https://control-plane.io<br />
<br />
=== <span id="TRAINING_2">Training 2 - OWASP Zap Training by David Scrobonia</span> ===<br />
<br />
==== Abstract ====<br />
<br />
This hands on course will start with the basics of using ZAP attack proxy and finish with leveraging it's API to integrate ZAP within you CI/CD processes. Along the way we will be practicing techniques by attacking the OWASP JuiceShop, an intentionally vulnerable web application. <br />
<br />
==== Audience ====<br />
<br />
This couse is designed for both new and experienced users. No knowledge or experience with ZAP is required, but even those familiar with ZAP will learn something new.<br />
<br />
==== Contents ====<br />
# Basic Techniques & Manual Testing <br />
# Advanced Techniques & Automated Testing<br />
# Scripting with ZAP<br />
# Using ZAP within your CI/CD Pipeline<br />
<br />
==== Bio ====<br />
<br />
David Scrobonia is a part of the Security Engineering team at Segment working to secure modern web apps and AWS infrastructure. He contributes to open source in his spare time and is a core team member of the OWASP ZAP project.<br />
<br />
=== <span id="TRAINING_3">Training 3 - Android security workshop by Jeroen Beckers & Stephanie Vanroelen</span> ===<br />
<br />
==== Abstract ====<br />
<br />
In this workshop, participants will come in contact with the basics of<br />
Android application security. Through hands-on exercises, Jeroen and<br />
Stephanie will show which mistakes can be made, both at the design and<br />
implementation level, that can compromise the security of both the<br />
application and the backend server. Although no real prior experience<br />
with Android is needed, some basic knowledge on programming is advised.<br />
<br />
==== Bio ====<br />
<br />
Jeroen Beckers is a security researcher at NVISO. He focusses mainly on<br />
mobile applications for Android/iOS and sometimes even Windows Phone<br />
(yes, some people actually use it!). Apart from breaking mobile<br />
applications, he also gives security trainings and presentations at<br />
conferences.<br><br />
<br><br />
Stephanie Vanroelen is an IT security consultant currently focussing on Web and<br />
Mobile Application Security. Her experiences in organizing IT Security<br />
conferences such as BruCON and CyberSKool help her with project<br />
management and communication skills. In her free time she pretends to be<br />
Godzilla :).<br />
<br />
<br />
<br />
<!-- Fifth tab --><br />
<br />
= Conference Day =<br />
<br />
'''Conference Day is November 30th'''<br />
<br />
== Talks == <br />
<br />
=== <span id="TALK_0915">OWASP Zap by David Scrobonia</span> ===<br />
<br />
==== Abstract ====<br />
<br />
Intoducing security testing tools to a QA or developers workflow can be difficult when the tools aren't easy or intuitive to use. Even for security professionals, the friction of cumbersome security tooling can prevent them from getting the most from a tool or being effective with their time.<br><br />
The OWASP ZAP team is working to help enable developers, QA, and hackers alike with the ZAP Heads Up Display, a more user friendly way to engage with the security testing tool. The Heads Up Displays integrates ZAP directly in the browser providing all of the funcitonality of the tool via a heads up display. The goal is to make ZAP more accessible and enabling users, especially developers, to integrate security in their daily workflows.<br><br />
This talk will discuss the importance of usable tools, design tradeoffs made to improve usability, the various browser technologies powering the HUD, and how you can start hacking with a heads up display.<br />
<br />
==== Bio ====<br />
<br />
David Scrobonia is a part of the Security Engineering team at Segment working to secure modern web apps and AWS infrastructure. He contributes to open source in his spare time and is a core team member of the OWASP ZAP project.<br />
<br />
=== <span id="TALK_1000">When Serverless Met Security… Serverless Security & Functions-as-a-Service (FaaS) by Niels Tanis</span> ===<br />
<br />
==== Abstract ====<br />
<br />
Serverless is a design pattern for writing scalable applications in which Functions as a Service (FaaS) is one of the key building blocks. Every mayor Cloud Provider has got his own FaaS available. On Microsoft Azure there is Azure Functions, AWS has got Lambda and Cloud Functions can be used on the Google Cloud. All of these have a lot of similarities in the way they allow developers to create small event driven services. <br><br />
From security perspective there are a lot of benefits when moving to a serverless architecture. There is no need to manage any of the machines and the underlying infrastructure. Dealing with updates, patches and infrastructure is the responsibility of the platform provider. FaaS are short lived processes which will be instantiated and destroyed in a matter of milliseconds making it more resilient to denial-of-services (DoS) and also makes it harder to attack and compromise. <br><br />
But will all of this be sufficient to be ’secure’ or should we be worried about more? With serverless there is still a piece of software that will be developed, build, deployed and executed. It will also introduce a more complex architecture with corresponding attack surface which also makes it hard to monitor. What about the software supply chain and delivery pipeline? There still will be a need to patch your software for vulnerabilities in code and used 3rd party libraries. In this talk we will identify the security area’s we do need to focus on when developing serverless and define possible solutions for dealing with those problems.<br />
<br />
==== Bio ====<br />
<br />
Niels Tanis has got a background in .NET development, pentesting and security consultancy. He also holds the CSSLP certification and has been involved in breaking, defending and building secure applications. He joined Veracode in 2015 and right now he works as a security researcher on a variant of languages and technologies related to Veracode’s Binary Static Analysis service. He is married, father of 2 and lives in a small village just outside Amersfoort, The Netherlands.<br />
<br />
<br />
=== <span id="TALK_1115">Weaknesses in our voice communications network: from Blue Boxing to VoLTE by Ralph Moonen</span> ===<br />
<br />
==== Abstract ====<br />
<br />
Voice over 4G, or VoLTE, brings back the phreaking 80's. Once again, after 3 decades, the signaling path of telephony is accessible to end users. No more R1, R2, C4 or C5 however: we now have SIP. As it turns out, the implementations of SIP and VoLTE in various European providers' 4G infrastructures, open up a host of possibilities. During our research over the past few years we have identified vulnerabilities in implementations such as txt message spoofing, subscriber enumeration, location determination (leakage of cell-ID and LAC), IMEI leakage and a potential SIM-card sharing attack.<br><br />
During this talk we will begin with a little historic stroll of phone phreaking through notable events and discoveries over the years. Bridging the narrative over the last few decades, new technologies such as VoIP, Volte, and VoWiFi are introduced, explaining the 4G and VoLTE infrastructure components and protocols. Next, on a rooted Android phone, we will show what control the user has over the VoLTE stack using some standard tools and the IPv6 stack. This includes hidden activities in Android and extraction of IPsec keys from the VoLTE stack. We will show that it is possible to import keys to Wireshark and monitor the IPv6 SIP traffic and components. Finally, examples of the vulnerabilities in implementations such as txt message spoofing, subscriber enumeration, location determination (leakage of cell-ID and LAC), IMEI leakage and a potential SIM-card sharing attack will be explained.<br><br />
Yes, a slightly technical nugget of knowledge, yet very accessible and a lot of fun!<br><br />
<br><br />
'''Importance of presentation for involved audience'''<br><br />
The phone systems of the world have always been of interest to everyone: from users who expect privacy, to intelligence agencies who want access. The privacy, integrity and confidentiality of voice communications over telecommunication networks is therefore of interest to anyone who uses mobile phones (i.e.: everyone). It is also typically a closed subject with very little research being done, relative to other security topics such as malware and application vulnerabilities. The combination of little research and high impact on everyone, makes that this topic deserves much more attention than it currently does. The VoLTE weaknesses we will describe are implementation dependent, and largely unpublished (i.e. new).<br />
<br />
==== Bio ====<br />
<br />
Ralph Moonen CISSP is Technical Director at Secura. Ralph is an old-school ethical hacker with 3 decades of experience as penetration tester, IT-auditor and security consultant. Now, as Technical Director, he is responsible for topics such as R&D and technical projects at Secura.<br />
<br />
=== <span id="TALK_1200">Juice Shop: OWASP's most broken Flagship by Björn Kimminich</span> ===<br />
<br />
==== Abstract ====<br />
<br />
OWASP Juice Shop is an intentionally insecure webapp for security trainings written entirely in Javascript which encompasses the entire OWASP Top Ten and many more severe security flaws. In this talk, you'll learn about this open-source project and its capabilities first-hand from its creator. Join a “happy shopper round trip,” enjoy a hacking demo of some of the built-in challenges, witness how to re-theme the Juice Shop into a security awareness booster for your own company, and learn how to set it up for a capture-the-flag (CTF) event in less than 5 minutes!<br />
<br />
====Bio====<br />
<br />
Björn Kimminich is responsible for global IT architecture and application security at Kuehne + Nagel. On the side, he gives IT security lectures at the non-profit private university Nordakademie. Björn also is the project leader of the OWASP Juice Shop and a board member for the German OWASP chapter. <br><br />
[[File:GitHub-Mark_no_background.png|25px|link=https://github.com/bkimminich|GitHub]]<br />
[[File:TwitterLogo.png|25px|link=http://twitter.com/bkimminich|Twitter]]<br />
[[File:LinkedinSquareLogo.png|25px|link=https://www.linkedin.com/in/bkimminich|LinkedIn]]<br />
<br />
=== <span id="TALK_1345">Fast forwarding Mobile Security with the MSTG by Jeroen Willemsen</span> ===<br />
<br />
==== Abstract ====<br />
<br />
After the startup of the mobile security project in 2010, the mobile security project and its testing guides have seen quiet some evolution. All of this changed quiet intensively when, in 2016, the Mobile Application Security Verification Standard (MASVS) and the Mobile Application Security Testing Guide (MSTG) were created. Now, two years fast forward: where are we now? How can you use it as a pentester or a developer? We will start with introducing the current state of the MSTG and its side-projects and then show various demos on iOS and Android.<br><br />
<br />
==== Bio ====<br />
<br />
Jeroen Willemsen is a Principal Security Architect at Xebia. With a love for mobile security, he recently became one of the projectleaders for the OMTG project (MASV & MSTG). Jeroen is more or less a jack of all trades with interest in infrastructure security, risk management and application security.<br />
<br />
=== <span id="TALK_1430">Leaky Processors: Stealing Your Secrets with Foreshadow by Jo Van Bulck</span> ===<br />
<br />
==== Abstract ====<br />
<br />
For decades, memory isolation has been one of the key principles of<br />
secure system design. The recent wave of speculative execution attacks,<br />
including Meltdown, Spectre, and Foreshadow abruptly showed, however,<br />
that performance optimizations in modern processors fundamentally<br />
undermine application security.<br><br />
This talk will review how speculative execution attacks work. What makes<br />
them dangerous, and why they require a paradigm shift in the way we<br />
think about application security. The talk will have a special focus on<br />
the recently disclosed Foreshadow CPU vulnerability, which led to a<br />
complete collapse of state-of-the-art Intel SGX technology, and<br />
necessitated hardware and software patches for all major operating<br />
systems and virtual machine hypervisors.<br />
<br />
==== Bio ====<br />
<br />
Jo Van Bulck is a PhD researcher at imec-DistriNet, KU Leuven, where he<br />
investigates hardware-level trusted computing from an integrated attack<br />
and defense perspective. His work resulted in a.o., the high-impact<br />
Foreshadow CPU vulnerability announced in August 2018, and several<br />
open-source secure processor prototypes.<br />
<br />
=== <span id="TALK_1545">Fast, Furious and Insecure: Passive Keyless Entry and Start in Modern Supercars by Lennert Wouters</span> ===<br />
<br />
==== Abstract ====<br />
<br />
The security of immobiliser and Remote Keyless Entry systems has been extensively studied over the past years. Passive Keyless Entry and Start systems, which are currently deployed in luxury vehicles, have not received as much attention.<br />
During this presentation we will share the techniques used in reverse engineering the Tesla Model S Passive Keyless Entry and Start system. We will discuss multiple security weaknesses in the system including the use of an inadequate proprietary cipher using 40-bit keys, the lack of mutual authentication in the challenge-response protocol, hardware configuration mistakes and the absence of security partitioning.<br><br />
We verified our findings by implementing a proof of concept attack allowing us to clone a Tesla Model S key fob in a matter of seconds with low cost commercial off the shelf equipment.<br><br />
Finally, we will share our experience with the responsible disclosure of these finding to Tesla Motors and other likely affected manufacturers such as McLaren, Karma Automotive and Triumph Motorcycles as they all use the same system developed by Pektron.<br />
<br />
====Bio====<br />
<br />
Lennert Wouters is a PhD researcher at the Computer Security and Industrial Cryptography (COSIC) research group at KU Leuven. His research interests involve hardware security of connected embedded devices and side channel attacks.<br />
<!--<br />
=== <span id="TALK_1630">TALK_1630_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
====Bio====<br />
<br />
TBD<br />
--><br />
<!-- Sixth tab --><br />
<br />
= Social Event =<br />
<br />
'''The Social Event is on Thursday, November 29th'''<br />
<br />
'''If you want to join the social event, don't forget to register for it via the registration:'''<br />
<br />
<!--[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |200px|alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]] --><br />
<br />
The social event details will be published very soon! Stay tuned.<br />
<!--<br />
Address: TBD<br />
<br />
Menu:TBD<br />
--><br />
<!-- Seventh tab --><br />
= Sponsor =<br />
<br />
''' Become a sponsor of OWASP BeNeLux! '''<br />
<br />
There are 3 combined sponsorship packages (Gold, Silver or Bronze) that cover the BeNeLux chapter meetings 2019 and the BeNeLux OWASP Days 2018.<br />
<br />
Download our [https://www.owasp.org/images/8/8e/OWASP_BeNeLux_2018_Sponsorship_Form_v20181004.pdf sponsor brochure] and contact [mailto:seba@owasp.org us] for questions or sponsorship confirmation!<br />
<br />
Your sponsorship will be invested directly in the chapter meetings, supporting speaker and catering expenses. <br />
<br />
The sponsorship will also be dedicated to cover the costs of the OWASP 2018 BeNeLux event.<br />
<br />
<!-- Don't remove these two lines! -->__NOTOC__ <br />
<headertabs></headertabs><br />
<br />
=== Made possible by our {{#switchtablink:Sponsor|Sponsors}}===<br />
<br />
==== Gold ====<br />
<br />
[[File:DavinsiLabs.png|250px|link=https://www.davinsilabs.com]]<br />
[http://www.vest.nl https://www.owasp.org/images/6/67/Vest.jpg]<br />
<br />
<br />
==== Silver ====<br />
<br />
[[File:LogoIngenicoGroup.png|250px|link=https://ingenico.be]]<br />
[[File:LogoToreon.jpg|250px|link=https://www.toreon.com]] <br />
[[File:LogoSynopsys.png|250px|link=https://www.synopsys.com]]<br />
<br />
<br />
<br />
<br />
==== Bronze ====<br />
<br />
[https://informatiebeveiliging.nl/ https://www.owasp.org/images/9/9a/Logo_Informatiebeveiliging-200.png]<br />
<br />
<br />
[[Category:OWASP_AppSec_Conference]] <br />
[[Category:OWASP_BeNeLux_Archives]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=Belgium&diff=244414Belgium2018-10-22T14:26:19Z<p>Sdeleersnyder: </p>
<hr />
<div>{{Chapter Template|chaptername=Belgium|extra=The chapter leaders are [mailto:seba@owasp.org Sebastien Deleersnyder], [mailto:lieven.desmet@owasp.org Lieven Desmet] and [mailto:bart.dewin@owasp.org Bart De Win]<br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-belgium|emailarchives=http://lists.owasp.org/pipermail/owasp-belgium}} <br />
<br />
= Local News =<br />
<br />
== OWASP BeNeLux Days ==<br />
<br />
* Our next [[OWASP BeNeLux-Days 2018|OWASP BeNeLux Days]] is on 29-30 November in the LAMOT conference center in Mechelen, Belgium.<br />
<br />
== Upcoming Chapter Meetings ==<br />
<br />
* [[Belgium_Events_2018#23_October_2018_Meeting|23 October 2018 Meeting in Bruges]] ([https://owasp-belgium-2018-10-23.eventbrite.com Registratrion via Eventbrite])<br />
<br />
See https://www.owasp.org/index.php/Belgium#Chapter_Meetings for more details and older meetings.<br />
<br />
== Stay in Touch ==<br />
<br />
<center><br />
{| cellspacing="15"<br />
|-<br />
| [[Image:Meetup-logo-2x.png|120px|link=http://www.meetup.com/Belgium-OWASP-Open-Web-Application-Security-Project/]] <br />
| [[Image:Join the list.png|150px|link=http://lists.owasp.org/mailman/listinfo/owasp-belgium]] <br />
| [[Image:Follow-us-on-twitter.png|175px|link=https://twitter.com/owasp_be]]<br />
| [[Image:Linkedin-button.gif|135px|link=https://www.linkedin.com/groups/37865]]<br />
|}<br />
</center><br />
If you want to be invited for the next OWASP Belgium Chapter meetings, please [http://eepurl.com/iFZtb drop us your contact info].<br />
<br />
== Structural Sponsors 2018 ==<br />
<br />
OWASP Belgium thanks its structural chapter supporters for 2018 and the OWASP BeNeLux Days 2017: <br />
<br />
[http://www.vest.nl https://www.owasp.org/images/6/67/Vest.jpg]<br />
[https://secwatch.nl https://www.owasp.org/images/f/ff/Secwatch_logo_small.png]<br />
[[File:Avi Logo Transparent Background 300pix.png|200px|link=https://avinetworks.com/]] <br />
[[File:LogoToreon.jpg|250px|link=https://www.toreon.com]] <br />
[[File:Nviso_logo_RGB_baseline_200px.png|link=http://www.nviso.be]] <br />
<br />
<br />
If you want to support our chapter, please contact [mailto:seba@owasp.org Seba Deleersnyder]<br />
<br />
= Chapter Meetings =<br />
<br />
{{:Belgium_Events_2018}}<br />
<br />
== Previous Years ==<br />
<br />
Events held in<br />
[[Belgium Events 2017|2017]],<br />
[[Belgium Events 2016|2016]],<br />
[[Belgium Events 2015|2015]],<br />
[[Belgium Events 2014|2014]],<br />
[[Belgium Events 2013|2013]],<br />
[[Belgium Events 2012|2012]],<br />
[[Belgium Events 2011|2011]],<br />
[[Belgium Events 2010|2010]],<br />
[[Belgium Events 2009|2009]],<br />
[[Belgium Events 2008|2008]],<br />
[[Belgium Events 2007|2007]],<br />
[[Belgium Events 2006|2006]],<br />
[[Belgium Events 2005|2005]].<br />
<br />
= Belgium OWASP Chapter Leaders =<br />
<br />
The Belgium Chapter is supported by the following board: <br />
<br />
Chapter Leaders<br />
*Sebastien Deleersnyder, Toreon<br />
*Lieven Desmet, KU Leuven <br />
*Bart De Win, PWC<br />
<br />
Board Members<br />
*Erwin Geirnaert, Zion Security<br />
*David Mathy, Freelance<br />
*Adolfo Solero, Freelance<br />
*Stella Dineva, Ingenico Payment Services<br />
*Thomas Herlea, NVISO<br />
<br />
Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects. <br />
__NOTOC__ <headertabs></headertabs><br />
[[Category:Europe]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&diff=244228OWASP SAMM Project2018-10-15T03:28:55Z<p>Sdeleersnyder: </p>
<hr />
<div>= Main = <br />
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''OWASP SAMM v1.5 available in the downloads section!'''<br />
<br />
'''Join our monthly calls'''<br />
* The monthly call is on each 2nd Wednesday of the month at 21h30 CEST / 3:30pm EST. <br><br />
* Please join our GoToMeeting: https://global.gotomeeting.com/join/262891661 <br><br />
* The call is open for everybody interested in SAMM or who wants to work on SAMM. <br><br />
<br />
'''2018 OWASP SAMM Summit (4-8 JUNE 2018, London)'''<br />
* Join our 2018 OWASP SAMM Summit near London as part of the [https://open-security-summit.org/ Open Security Summit].<br><br />
* We will organize working sessions in a 5-day sprint to draft SAMM v2.0. <br />
* Register online [https://open-security-summit.org/tickets/ here]<br />
* Sponsor the SAMM2, more details [https://www.owasp.org/index.php/OWASP_SAMM_Project#tab=Project_Sponsors here]<br />
<br />
<br />
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:<br />
* '''Evaluate an organization’s existing software security practices'''<br />
* '''Build a balanced software security assurance program in well-defined iterations'''<br />
* '''Demonstrate concrete improvements to a security assurance program'''<br />
* '''Define and measure security-related activities throughout an organization'''<br />
<br />
<br />
<br />
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'', ('''Michael J. Craigue, Information Security & Compliance, Dell, Inc.''')<br />
<br />
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]<br />
<br />
{{Social Media Links}}<br />
<br />
| valign="top" style="padding-left:25px;width:200px;" |<br />
<br />
== Quick Download v1.5 ==<br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick Start Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Toolbox Example] <br><br />
[https://github.com/OWASP/samm/ OWASP SAMM on GitHub]<br />
<br />
== Quick Download v1.1.1 ==<br />
<br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]<br><br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box]<br><br />
[https://github.com/OWASP/samm OWASP SAMM on GitHub]<br />
<br />
== News and Events ==<br />
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs<br />
<br />
== Change Log ==<br />
* OWASP SAMM v1.5 Released! ([http://www.prnewswire.com/news-releases/owasp-samm-v15-helps-organizations-improve-their-security-posture-300439237.html Press Release])<br />
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
== Email List ==<br />
<br />
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]<br />
<br />
== Project Leaders ==<br />
<br />
[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] <br /> [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win]<br />
<br />
== Related Projects ==<br />
<br />
*<br />
<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]<br />
| align="center" valign="center" width="50%" | [[File:Owasp-defenders-small.png|link=]]<br />
|<br />
|-<br />
| align="center" valign="center" width="50%" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= Browse Online =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.<br />
<br />
[[Image:SAMM-Overview.png|720px]]<br />
<br />
===== Click on any badge to learn more =====<br />
<br />
{| cellpadding="1"<br />
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]<br />
|-<br />
| align="center" |'''Strategy & Metrics'''<br />
|{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM|padding=0}}<br />
|-<br />
| align="center" |'''Policy & Compliance'''<br />
|{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC|padding=0}}<br />
|-<br />
| align="center" |'''Education & Guidance'''<br />
|{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]<br />
|-<br />
| align="center" |'''Threat Assessment'''<br />
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}<br />
|-<br />
| align="center" |'''Security Requirements'''<br />
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}<br />
|-<br />
| align="center" |'''Secure Architecture'''<br />
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]<br />
|-<br />
| align="center" |'''Design Review'''<br />
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}<br />
|-<br />
| align="center" |'''Code Review'''<br />
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}<br />
|-<br />
| align="center" |'''Security Testing'''<br />
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]<br />
|-<br />
| align="center" |'''Vulnerability Management'''<br />
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}<br />
|-<br />
| align="center" |'''Environment Hardening'''<br />
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}<br />
|-<br />
| align="center" |'''Operational Enablement'''<br />
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}<br />
|-<br />
|}<br />
<br />
= Downloads =<br />
<br />
The latest work in progress can be found on Github: https://github.com/OWASP/samm<br />
<br />
Download SAMM v1.5<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] Zip file containing all the v1.5 files below;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] to perform SAMM assessments and create SAMM roadmaps;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Tool Box Example] to provide an example SAMM assessment;<br />
<br />
Download SAMM v1.1<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;<br />
<br />
Download OpenSAMM v1.0:<br />
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML<br />
* in [https://www.owasp.org/images/f/fd/SAMM-1.0-cn.pdf Chinese - PDF], not available as XML<br />
<br />
<br />
Available resources to apply SAMM:<br />
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]<br />
<br />
<br />
Trainings:<br />
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge<br />
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]<br />
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]<br />
<br />
<br />
Assessments:<br />
* SAMM v1.5 Toolbox<br />
** Download the new v1.5 Toolbox with the updated scoring model [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM v1.5 Toolbox]<br />
* SAMM v1.1 Toolbox<br />
** download the v1.1 toolbox, including the updated questions [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx here]<br />
* Assessment Interview Template by Nick Coblentz for SAMM V1.0<br />
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.<br />
* Roadmap Chart Template by Colin Watson for SAMM V1.0<br />
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.<br />
* Assessment Worksheet by Christian Frichot for SAMM V1.0<br />
** This is an easy-to-use [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.<br />
* Project Plan Template by Jim Weiler for SAMM V1.0<br />
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.<br />
<br />
<br />
Mappings:<br />
* BSIMM-6 mapping to SAMM activities:<br />
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]<br />
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]<br />
* BSIMM mapping to SAMM during the 2011 Summit:<br />
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).<br />
<br />
<br />
Tools:<br />
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]<br />
<br />
= Community =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}<br />
<br />
</div><br />
<br />
= Summit =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 >here<] !!<br />
<br />
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit<br />
<br />
<br />
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 >here<] !!<br />
<br />
Summit Notes:<br />
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit<br />
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]<br />
''"The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers."'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company<br />
<br />
Previous workshop Notes:<br />
<br />
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.<br />
<br />
This is also an excellent opportunity to exchange experiences with your peers.<br />
<br />
If you plan on attending http://appsec.eu be sure to get involved in the SAMM workshop (scheduled on Jun-23).<br />
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].<br />
<br />
Previous workshop notes:<br />
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].<br />
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].<br />
<br />
<br />
= Talks =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
Upcoming talks featuring SAMM are listed here:<br />
<br />
* OWASP DC - Software Assurance Maturity Model (SAMM) with Brian Glas! (2017-03-15)<br />
* OWASP NoVA - SAMM 1.5, what's changed and how it impacts you (2017-03-16)<br />
* InfoSec World - Software Assurance Maturity Model Evolutions (2017-04-03)<br />
<br />
past talks:<br />
<br />
* OWASP SAMM v1.5 Webinar - Brian Glas discussing the SAMM model and changes in v1.5 (watch - [https://www.youtube.com/watch?v=4pKdwRb8fTI youtube]) - 2017<br />
* OWASP 24/7 - Seba Deleersnyder discussing the upcoming SAMM Summit (listen - [https://soundcloud.com/owasp-podcast/seba-deleersnyder-discusses-samm-software-assurance-maturity-model-summit-in-dublin-ireland here]) - 2015<br />
* OWASP Germany Day 2014: Seba Deleersnyder: OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/f/fa/OpenSAMM_Best_Practices_Lessons_from_the_Trenches_-_Seba_Deleersnyder.pdf presentation]) - 2014<br />
* AppSecEU14: Seba Deleersnyder & Bart De Win: OpenSAMM Best Practices: Lessons from the Trenches OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/6/6f/OpenSAMM_-_AppSecEU_2014_-_Seba-Bart_v20140528.pptx presentation], see [https://www.youtube.com/watch?v=qcCgeBeBLUg video]) - 2014<br />
* AppSecEU13 - Hamburg: Seba Deleersnyder presenting a project update (download [https://www.owasp.org/images/3/32/OpenSAMM_-_Project_Status_-_Hamburg_2013.pdf presentation]) - 2013<br />
* OWASP Europe Tour 2013 - Geneva: Seba Deleersnyder presenting OpenSAMM and the renewed project (download [https://www.owasp.org/images/c/cd/OpenSAMM_-_OWASP_Tour_13_Talk_-_Seba.pptx presentation]) - 2013<br />
* AppSecEU11 - Athens: Colin Watson presenting SAMM Training (download [https://www.owasp.org/images/1/18/Owasp-training-samm-greece.pdf presentation]) - 2011<br />
* AppSecEU09: Pravir Chandra presenting OpenSAMM v1.0 (download [https://www.owasp.org/images/4/49/AppSecEU09_OpenSAMM-1.0.ppt presentation]) - 2009<br />
* Matt Bartoldus presentation on new SAMM project during OWASP London chapter (download [https://www.owasp.org/images/d/df/OpenSAMM.pdf presentation]) - 2009<br />
* Pravir Chandra - first presentation discussing the next generation to the CLASP Project- a complete working of the details into a Software Assurance Maturity Model (SAMM). (download [https://www.owasp.org/images/2/2e/OWASP_CLASP_SAMM.ppt presentation]) - 2009<br />
<br />
</div><br />
<br />
= News =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Latest News on SAMM<br />
* OWASP SAMM v2.0 workshop at the OWASP Project Summit June 2017<br />
* OWASP SAMM v1.5 Released!<br />
* SAMM Summit 2016 read the [https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit wrap-up here] <br />
* OWASP SAMM v1.1 Released! See the [http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release].<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
</div><br />
<br />
= Languages =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''SAMM v1.0 is available in the following languages:'''<br />
<br />
* English<br />
* Spanish<br />
* Japanese<br />
* Chinese<br />
<br />
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].<br />
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!<br />
<br />
</div><br />
<br />
= Roadmap =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Updated roadmap:<br />
Next 1.5 release, updated scoring:<br />
* Clarification of maturity levels (syntactic changes to keep the text consistent)<br />
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. <br />
* Show improvements with every activity introduced<br />
* Adapt for the new scoring method<br />
* Update questions for 4-tiers<br />
* Review and where necessary clarify current questions<br />
* Consider v1.1 remarks that were not withheld for the previous release<br />
Targeted completion date: February 28, 2017<br />
<br />
SAMM version 2.0<br />
* Core model changed<br />
* Visualisations + flavours for a few development methodologies<br />
* Update quickstart guide, TB, HTG. <br />
* Success metrics: How well does the model work: Linked to the benchmarking project.<br />
Timing: Workshops as part of OWASP Project Summit June 2017<br />
<br />
</div><br />
= Get Involved =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Involvement in the development of SAMM is actively encouraged!<br />
<br />
You do not have to be a security expert in order to contribute.<br />
<br />
Some of the ways you can help:<br />
<br />
==Feedback==<br />
<br />
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:<br />
* What do like?<br />
* What don't you like?<br />
* How can we make SAMM easier to use?<br />
* How could SAMM be improved? <br />
<br />
<br />
==Localization==<br />
<br />
Are you fluent in another language? Can you help translate SAMM into that language?<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!<br />
<br />
</div><br />
<br />
= Project Sponsors =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
SAMM is developed and maintained by a worldwide team of volunteers. We have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM.<br />
<br />
==SAMM Adopters==<br />
SAMM is the premier open source software assurance framework. You can find a list of [https://www.owasp.org/index.php/OpenSAMM_Adopters SAMM adopters] online.<br />
<br />
==Call for SAMM2 Sponsors==<br />
OWASP SAMM and the upcoming SAMM 2.0 release is the open source software security maturity model used to develop secure software for IT, application and software security technologists. <br />
<br />
We are seeking sponsors to support OWASP SAMM. All proceeds from the sponsorship support the mission of the OWASP Foundation and the further development of SAMM. Supporting the project drives the funding for research grants, SAMM hosting, tools, templates, documents, promotion, and more.<br />
<br />
By sponsoring SAMM, you not only support an important and flagship OWASP project, you will also get visibility during the next SAMM Summit (part of the OWASP Summit 2018) and recognition on the OWASP SAMM project web site and the next release of SAMM (version 2.0).<br />
<br />
For more information: Contact [mailto:seba@owasp.org seba@owasp.org]<br />
<br />
==== Acknowledgements ====<br />
<br />
<br />
<br />
We would like to thank the following sponsors who donated funds to our project:<br />
<br />
[[File:OWASP-NoVA-Chapter-Logo.PNG|250px|link=https://www.owasp.org/index.php/Virginia]]<br />
[[File:Belgium_Chapter.PNG|250px|link=https://www.owasp.org/index.php/Belgium]]<br />
[[File:London_Chapter.PNG|250px|link=https://www.owasp.org/index.php/London]]<br />
<br />
[[File:Aspectsecurity.png|250px|link=http://www.aspectsecurity.com]]<br />
[[File:Astech_Consulting_logo.png|250px|link=http://www.astechconsulting.com/]] <br />
[[File:Denim_Group_logo.jpg|250px|link=http://www.denimgroup.com/]] <br />
[[File:Gotham_Digital_Science_logo.jpg|250px|link=http://www.gdssecurity.com/]] <br />
<br />
{{MemberLinksv2|link=http://www.hpenterprisesecurity.com|logo=HP_Blue_RGB_150_SM.png|size=300px90px}} <br />
[[File:NetSPI_logo.png|250px|link=http://www.netspi.com/]] <br />
[[Image:PwC_logo_4colourprint_(2)_Resized_good_one.jpg|150px|link=http://www.pwc.com]]<br />
[[File:SI_Logo_Stacked_Application_Security.jpg|250px|link=http://www.securityinnovation.com/]] <br />
[[File:LogoToreon.jpg|250px|link=http://www.toreon.com]] <br />
[[File:Veracode-samm.png|250px|link=http://www.veracode.com]] <br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
<br /><br />
{{OWASP Book|6888083}}<br />
<br /><br />
<br />
[[Category:OWASP Project|Zed Attack Proxy Project]]<br />
[[Category:OWASP_Tool]]<br />
[[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]]<br />
[[Category:OWASP_Download]]<br />
[[Category:Popular]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_BeNeLux-Days_2018&diff=244104OWASP BeNeLux-Days 20182018-10-10T05:07:58Z<p>Sdeleersnyder: Sdeleersnyder moved page OWASP BeNeLux-Day 2018 to OWASP BeNeLux-Days 2018: correct event name</p>
<hr />
<div><center>[[Image:OBNL18 Banner v2.png]]</center><br />
<br />
<br><!-- Header --><br />
<br />
<br />
<!-- First tab --><br />
= Information =<br />
<!-- <br />
== Keynote Speaker ==<br />
<br />
{{#switchtablink:Conference Day|<p><br />
* TBD<br />
}}<br />
--><br />
== Confirmed Conference Speakers ==<br />
<br />
{{#switchtablink:Conference_Day|<p><br />
* David Scrobonia<br />
* Niels Tanis<br />
* Jeroen Willemsen<br />
}}<br />
<br />
== Confirmed Trainers ==<br />
<br />
{{#switchtablink:Training Day|<p><br />
* Andrew Martin<br />
* David Scrobonia<br />
}}<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
<br />
== The OWASP BeNeLux Program Committee ==<br />
<br />
*Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium<br />
*Martin Knobloch / Joren Poll, OWASP Netherlands<br />
*Jocelyn Aubert, OWASP Luxembourg<br />
<br />
== Tweet! ==<br />
<br />
Event tag is [http://twitter.com/#search?q=%23owaspbnl17 #owaspbnl18]<br />
<br />
== Donate to OWASP BeNeLux ==<br />
<br />
[https://co.clickandpledge.com/?wid=72689 Donate]<br />
<br />
<!-- Second tab --><br />
= Registration =<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
<br />
<!--<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
--><br />
<br />
== OWASP BeNeLux training is reserved for OWASP members, and registration is required! ==<br />
<br />
To support the OWASP organisation, we ask training attendees to consider becoming an OWASP member, it's only US$50!<br />
Check out the [[Membership]] page to find out more. <br />
<br />
<!--<br />
[https://owasp-benelux-day-2018.eventbrite.com Register now!]<br />
--><br />
<br />
To support the OWASP organisation, consider to become a member, it's only US$50! Check out the [[Membership]] page to find out more. <br />
<br />
<!-- Third tab --><br />
= Venue =<br />
<br />
== Address ==<br />
<br />
Venue:<br />
<br />
'''Congres- en Erfgoedcentrum Lamot'''<br />
Van Beethovenstraat 8-10<br />
2800 Mechelen<br />
Belgium<br />
<br />
[https://goo.gl/maps/gZ9icR178w52 Google map]<br />
<br /><br />
[[File:Mechelen-Lamot.jpg|350px|Lamot conference center]]<br />
[[File:Mechelen-lamot-center-auditorium.jpg|350px|Auditorium]]<br /><br />
<br />
Parking:<br /><br />
[[File:Parking lots around Lamot Conference center Mechelen.png|500px|Parking facilities]]<br /><br />
[https://goo.gl/maps/Q5TD7hoTuUu Find your parking on Google Maps]<br />
<br />
=== How to reach the venue? ===<br />
<br />
==== Public transport ====<br />
<br />
You can reach the Mechelen's train station from Antwerpen or Brussels.<br />
The Lamot conference center is 10 min away by bus (line 1).<br />
<br />
Or you can choose to walk for 15 min (1.2 km).<br />
<br />
<br />
==== By car ====<br />
<br />
===== From Brussels: =====<br />
Follow the E19 Brussels / Antwerpen and take the exit 10. <br> Follow the N1 until the R12 (take a left) and turn to the right at the "Brusselpoort" into the Hoogstraat to reach one of the parkings.<br />
<br />
===== From Antwerpen: =====<br />
Follow the E19 Brussels / Antwerpen and take the exit 9. <br> Follow the N16 until the R12 (take a right) and turn to the left at the "Brusselpoort" into the Hoogstraat to reach one of the parkings. <br />
<br />
<br />
=== Hotels Nearby ===<br />
[https://www.google.com/maps/d/viewer?mid=1eYMYmwXKuAsTilKgpAtyYtfMA7A&ll=51.02648134397288%2C4.47819800000002&z=15 Hotels around the Lamot conference center]<br />
<br />
<!-- Fourth tab --><br />
= Training Day =<br />
<br />
'''Training Day is November 29th'''<br />
<!-- <br />
== Agenda (TBD)==<br />
<br />
{| class="wikitable"<br />
! Time !! Description !! Room TBA !! Room TBA !! Room TBA<br />
|-<br />
| 08h30 - 9h30<br />
| colspan="5" style="text-align: center; background: grey; color: white;" | ''Registration''<br />
|-<br />
| 09h30 - 11h00 || Training<br />
| rowspan="7" style="width:100px;" | [[#TRAINING_1 | Kubernetes security]] by Andrew Martin<br />
| rowspan="7" style="width:100px;" | [[#TRAINING_2 | TRAINING_2_TITLE]] by TRAINING_2_TRAINER<br />
| rowspan="7" style="width:100px;" | [[#TRAINING_3 | TRAINING_3_TITLE]] by TRAINING_3_TRAINER<br />
|-<br />
| 11h00 - 11h30 || ''Coffee Break''<br />
|-<br />
| 11h30 - 13h00 || Training<br />
|-<br />
| 13h00 - 14h00 || ''Lunch''<br />
|-<br />
| 14h00 - 15h30 || Training<br />
|-<br />
| 15h30 - 16h00 || ''Coffee Break''<br />
|-<br />
| 16h00 - 17h30 || Training<br />
|}<br />
--><br />
== Trainings ==<br />
<br />
=== <span id="TRAINING_1">Kubernetes security by Andrew Martin</span> ===<br />
<br />
==== Abstract ====<br />
<br />
===== Course Description =====<br />
The course guides attendees through Linux container security in general, and progresses to advanced Kubernetes cluster security. It emphasises pragmatic threat modelling and risk assessment based on an understanding of the tools and primitives available, rather than dogmatic dos and don’ts.<br />
<br />
===== Course Outline =====<br />
* How to attack containerised workloads<br />
* Enhanced container security<br />
* How to attack Kubernetes<br />
* Interactive production cluster hacking<br />
* Hardening Kubernetes<br />
* Locking down applications<br />
* Security tooling and vendor landscape<br />
<br />
===== Who Should Attend =====<br />
This course is suitable for intermediate to advanced Kubernetes users who want to strengthen their security understanding. It is particularly beneficial for those operating Kubernetes in a high-compliance domain, or for established security professionals looking to update their skills for the cloud native world.<br />
<br />
==== Bio ====<br />
<br />
Andrew has a strong test-first engineering ethos gained architecting and deploying high-traffic web applications. Proficient in systems development, testing, and maintenance, he is comfortable profiling and securing every tier of a bare metal or cloud native application, and has battle-hardened experience delivering containerised solutions to enterprise clients. He is a co-founder at https://control-plane.io<br />
<!--<br />
=== <span id="TRAINING_2">TRAINING_2_TITLE by TRAINING_2_TRAINER</span> ===<br />
<br />
==== Topic(s) ====<br />
<br />
* TRAINING_2_TOPIC_1<br />
* TRAINING_2_TOPIC_2<br />
* ...<br />
<br />
==== Keywords ====<br />
<br />
TRAINING_2_KEYWORD_1, TRAINING_2_KEYWORD_2, ...<br />
<br />
==== Abstract ====<br />
<br />
TRAINING_2_ABSTRACT<br />
<br />
==== Requirements ====<br />
<br />
TRAINING_2_REQUIREMENTS<br />
<br />
==== Bio ====<br />
<br />
TRAINING_2_TRAINER_BIO<br />
<br />
=== <span id="TRAINING_3">TRAINING_3_TITLE by TRAINING_3_TRAINER</span> ===<br />
<br />
==== Topic(s) ====<br />
<br />
* TRAINING_3_TOPIC_1<br />
* TRAINING_3_TOPIC_2<br />
* ...<br />
<br />
==== Keywords ====<br />
<br />
TRAINING_3_KEYWORD_1, TRAINING_3_KEYWORD_2, ...<br />
<br />
==== Abstract ====<br />
<br />
TRAINING_3_ABSTRACT<br />
<br />
==== Requirements ====<br />
<br />
TRAINING_3_REQUIREMENTS<br />
<br />
==== Bio ====<br />
<br />
TRAINING_3_TRAINER_BIO<br />
--><br />
<!-- Fifth tab --><br />
= Conference Day =<br />
<br />
'''Conference Day is November 30th'''<br />
<br />
== Talks == <br />
<br />
=== <span id="TALK_0915">OWASP Zap by David Scrobonia</span> ===<br />
<br />
==== Abstract ====<br />
<br />
Intoducing security testing tools to a QA or developers workflow can be difficult when the tools aren't easy or intuitive to use. Even for security professionals, the friction of cumbersome security tooling can prevent them from getting the most from a tool or being effective with their time.<br><br />
The OWASP ZAP team is working to help enable developers, QA, and hackers alike with the ZAP Heads Up Display, a more user friendly way to engage with the security testing tool. The Heads Up Displays integrates ZAP directly in the browser providing all of the funcitonality of the tool via a heads up display. The goal is to make ZAP more accessible and enabling users, especially developers, to integrate security in their daily workflows.<br><br />
This talk will discuss the importance of usable tools, design tradeoffs made to improve usability, the various browser technologies powering the HUD, and how you can start hacking with a heads up display.<br />
<br />
==== Bio ====<br />
<br />
David Scrobonia is a part of the Security Engineering team at Segment working to secure modern web apps and AWS infrastructure. He contributes to open source in his spare time and is a core team member of the OWASP ZAP project.<br />
<br />
=== <span id="TALK_1000">When Serverless Met Security… Serverless Security & Functions-as-a-Service (FaaS) by Niels Tanis</span> ===<br />
<br />
==== Abstract ====<br />
<br />
Serverless is a design pattern for writing scalable applications in which Functions as a Service (FaaS) is one of the key building blocks. Every mayor Cloud Provider has got his own FaaS available. On Microsoft Azure there is Azure Functions, AWS has got Lambda and Cloud Functions can be used on the Google Cloud. All of these have a lot of similarities in the way they allow developers to create small event driven services. <br><br />
From security perspective there are a lot of benefits when moving to a serverless architecture. There is no need to manage any of the machines and the underlying infrastructure. Dealing with updates, patches and infrastructure is the responsibility of the platform provider. FaaS are short lived processes which will be instantiated and destroyed in a matter of milliseconds making it more resilient to denial-of-services (DoS) and also makes it harder to attack and compromise. <br><br />
But will all of this be sufficient to be ’secure’ or should we be worried about more? With serverless there is still a piece of software that will be developed, build, deployed and executed. It will also introduce a more complex architecture with corresponding attack surface which also makes it hard to monitor. What about the software supply chain and delivery pipeline? There still will be a need to patch your software for vulnerabilities in code and used 3rd party libraries. In this talk we will identify the security area’s we do need to focus on when developing serverless and define possible solutions for dealing with those problems.<br />
<br />
==== Bio ====<br />
<br />
Niels Tanis has got a background in .NET development, pentesting and security consultancy. He also holds the CSSLP certification and has been involved in breaking, defending and building secure applications. He joined Veracode in 2015 and right now he works as a security researcher on a variant of languages and technologies related to Veracode’s Binary Static Analysis service. He is married, father of 2 and lives in a small village just outside Amersfoort, The Netherlands.<br />
<br />
<!--<br />
=== <span id="TALK_1115">TALK_1115_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
==== Bio ====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1200">TALK_1200_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
====Bio====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1345">TALK_1345_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
==== Bio ====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1430">TALK_1430_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
==== Bio ====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1545">TALK_1545_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
====Bio====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1630">TALK_1630_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
====Bio====<br />
<br />
TBD<br />
--><br />
<!-- Sixth tab --><br />
= Social Event =<br />
<br />
'''The Social Event is on Thursday, November 29th'''<br />
<br />
'''If you want to join the social event, don't forget to register for it via the registration:'''<br />
<br />
<!--[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |200px|alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]] --><br />
<br />
The social event details will be published very soon! Stay tuned.<br />
<!--<br />
Address: TBD<br />
<br />
Menu:TBD<br />
--><br />
<!-- Seventh tab --><br />
= Sponsor =<br />
<br />
''' Become a sponsor of OWASP BeNeLux! '''<br />
<br />
There are 3 combined sponsorship packages (Gold, Silver or Bronze) that cover the BeNeLux chapter meetings 2019 and the BeNeLux OWASP Days 2018.<br />
<br />
Download our [https://www.owasp.org/images/8/8e/OWASP_BeNeLux_2018_Sponsorship_Form_v20181004.pdf sponsor brochure] and contact [mailto:seba@owasp.org us] for questions or sponsorship confirmation!<br />
<br />
Your sponsorship will be invested directly in the chapter meetings, supporting speaker and catering expenses. <br />
<br />
The sponsorship will also be dedicated to cover the costs of the OWASP 2018 BeNeLux event.<br />
<br />
<!-- Don't remove these two lines! -->__NOTOC__ <br />
<headertabs></headertabs><br />
<br />
=== Made possible by our {{#switchtablink:Sponsor|Sponsors}}===<br />
<br />
==== Gold ====<br />
<br />
[[File:DavinsiLabs.png|250px|link=https://www.davinsilabs.com]]<br />
[http://www.vest.nl https://www.owasp.org/images/6/67/Vest.jpg]<br />
<br />
<br />
==== Silver ====<br />
<br />
[[File:LogoIngenicoGroup.png|250px|link=https://ingenico.be]]<br />
[[File:LogoToreon.jpg|250px|link=https://www.toreon.com]] <br />
[[File:LogoSynopsys.png|250px|link=https://www.synopsys.com]]<br />
<br />
<br />
<br />
<br />
==== Bronze ====<br />
<br />
[https://informatiebeveiliging.nl/ https://www.owasp.org/images/9/9a/Logo_Informatiebeveiliging-200.png]<br />
<br />
<br />
[[Category:OWASP_AppSec_Conference]] <br />
[[Category:OWASP_BeNeLux_Archives]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_BeNeLux-Day_2018&diff=244105OWASP BeNeLux-Day 20182018-10-10T05:07:58Z<p>Sdeleersnyder: Sdeleersnyder moved page OWASP BeNeLux-Day 2018 to OWASP BeNeLux-Days 2018: correct event name</p>
<hr />
<div>#REDIRECT [[OWASP BeNeLux-Days 2018]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_BeNeLux-Days_2018&diff=243985OWASP BeNeLux-Days 20182018-10-04T05:05:20Z<p>Sdeleersnyder: </p>
<hr />
<div><center>[[Image:OBNL18 Banner v2.png]]</center><br />
<br />
<br><!-- Header --><br />
<br />
<br />
<!-- First tab --><br />
= Information =<br />
<br />
== Keynote Speaker ==<br />
<br />
{{#switchtablink:Conference Day|<p><br />
* TBD<br />
}}<br />
<br />
== Confirmed Conference Speakers ==<br />
<br />
{{#switchtablink:Conference Day|<p><br />
* TBD<br />
}}<br />
<br />
== Confirmed Trainers ==<br />
<br />
{{#switchtablink:Training Day|<p><br />
* TBD<br />
}}<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
<br />
== The OWASP BeNeLux Program Committee ==<br />
<br />
*Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium<br />
*Martin Knobloch / Joren Poll, OWASP Netherlands<br />
*Jocelyn Aubert, OWASP Luxembourg<br />
<br />
== Tweet! ==<br />
<br />
Event tag is [http://twitter.com/#search?q=%23owaspbnl17 #owaspbnl18]<br />
<br />
== Donate to OWASP BeNeLux ==<br />
<br />
[https://co.clickandpledge.com/?wid=72689 Donate]<br />
<br />
<!-- Second tab --><br />
= Registration =<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
<br />
<!--<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
--><br />
<br />
== OWASP BeNeLux training is reserved for OWASP members, and registration is required! ==<br />
<br />
To support the OWASP organisation, we ask training attendees to consider becoming an OWASP member, it's only US$50!<br />
Check out the [[Membership]] page to find out more. <br />
<br />
<!--<br />
[https://owasp-benelux-day-2018.eventbrite.com Register now!]<br />
--><br />
<br />
To support the OWASP organisation, consider to become a member, it's only US$50! Check out the [[Membership]] page to find out more. <br />
<br />
<!-- Third tab --><br />
= Venue =<br />
<br />
== Address ==<br />
<br />
Venue:<br />
<br />
'''Congres- en Erfgoedcentrum Lamot'''<br />
Van Beethovenstraat 8-10<br />
2800 Mechelen<br />
Belgium<br />
<br />
[https://goo.gl/maps/gZ9icR178w52 Google map]<br />
<br /><br />
[[File:Mechelen-Lamot.jpg|350px|Lamot conference center]]<br />
[[File:Mechelen-lamot-center-auditorium.jpg|350px|Auditorium]]<br /><br />
<br />
Parking:<br /><br />
[[File:Parking lots around Lamot Conference center Mechelen.png|500px|Parking facilities]]<br /><br />
[https://goo.gl/maps/Q5TD7hoTuUu Find your parking on Google Maps]<br />
<br />
=== How to reach the venue? ===<br />
<br />
==== Public transport ====<br />
<br />
You can reach the Mechelen's train station from Antwerpen or Brussels.<br />
The Lamot conference center is 10 min away by bus (line 1).<br />
<br />
Or you can choose to walk for 15 min (1.2 km).<br />
<br />
<br />
==== By car ====<br />
<br />
===== From Brussels: =====<br />
Follow the E19 Brussels / Antwerpen and take the exit 10. <br> Follow the N1 until the R12 (take a left) and turn to the right at the "Brusselpoort" into the Hoogstraat to reach one of the parkings.<br />
<br />
===== From Antwerpen: =====<br />
Follow the E19 Brussels / Antwerpen and take the exit 9. <br> Follow the N16 until the R12 (take a right) and turn to the left at the "Brusselpoort" into the Hoogstraat to reach one of the parkings. <br />
<br />
<br />
=== Hotels Nearby ===<br />
[https://www.google.com/maps/d/viewer?mid=1eYMYmwXKuAsTilKgpAtyYtfMA7A&ll=51.02648134397288%2C4.47819800000002&z=15 Hotels around the Lamot conference center]<br />
<br />
<!-- Fourth tab --><br />
= Training Day =<br />
<br />
'''Training Day is November 29th'''<br />
<br />
== Agenda (TBD)==<br />
<br />
{| class="wikitable"<br />
! Time !! Description !! Room TBA !! Room TBA !! Room TBA<br />
|-<br />
| 08h30 - 9h30<br />
| colspan="5" style="text-align: center; background: grey; color: white;" | ''Registration''<br />
|-<br />
| 09h30 - 11h00 || Training<br />
| rowspan="7" style="width:100px;" | [[#TRAINING_1 | TRAINING_1_TITLE]] by TRAINING_1_TRAINER<br />
| rowspan="7" style="width:100px;" | [[#TRAINING_2 | TRAINING_2_TITLE]] by TRAINING_2_TRAINER<br />
| rowspan="7" style="width:100px;" | [[#TRAINING_3 | TRAINING_3_TITLE]] by TRAINING_3_TRAINER<br />
|-<br />
| 11h00 - 11h30 || ''Coffee Break''<br />
|-<br />
| 11h30 - 13h00 || Training<br />
|-<br />
| 13h00 - 14h00 || ''Lunch''<br />
|-<br />
| 14h00 - 15h30 || Training<br />
|-<br />
| 15h30 - 16h00 || ''Coffee Break''<br />
|-<br />
| 16h00 - 17h30 || Training<br />
|}<br />
<br />
== Trainings ==<br />
<br />
=== <span id="TRAINING_1">TRAINING_1_TITLE by TRAINING_1_TRAINER</span> ===<br />
<br />
==== Topic(s) ====<br />
<br />
* TRAINING_1_TOPIC_1<br />
* TRAINING_1_TOPIC_2<br />
<br />
==== Keywords ====<br />
<br />
TRAINING_1_KEYWORD_1, TRAINING_1_KEYWORD_2<br />
<br />
==== Abstract ====<br />
<br />
TRAINING_1_ABSTRACT<br />
<br />
==== Requirements ====<br />
<br />
TRAINING_1_REQUIREMENTS<br />
<br />
==== Bio ====<br />
<br />
TRAINING_1_TRAINER_BIO<br />
<br />
=== <span id="TRAINING_2">TRAINING_2_TITLE by TRAINING_2_TRAINER</span> ===<br />
<br />
==== Topic(s) ====<br />
<br />
* TRAINING_2_TOPIC_1<br />
* TRAINING_2_TOPIC_2<br />
* ...<br />
<br />
==== Keywords ====<br />
<br />
TRAINING_2_KEYWORD_1, TRAINING_2_KEYWORD_2, ...<br />
<br />
==== Abstract ====<br />
<br />
TRAINING_2_ABSTRACT<br />
<br />
==== Requirements ====<br />
<br />
TRAINING_2_REQUIREMENTS<br />
<br />
==== Bio ====<br />
<br />
TRAINING_2_TRAINER_BIO<br />
<br />
=== <span id="TRAINING_3">TRAINING_3_TITLE by TRAINING_3_TRAINER</span> ===<br />
<br />
==== Topic(s) ====<br />
<br />
* TRAINING_3_TOPIC_1<br />
* TRAINING_3_TOPIC_2<br />
* ...<br />
<br />
==== Keywords ====<br />
<br />
TRAINING_3_KEYWORD_1, TRAINING_3_KEYWORD_2, ...<br />
<br />
==== Abstract ====<br />
<br />
TRAINING_3_ABSTRACT<br />
<br />
==== Requirements ====<br />
<br />
TRAINING_3_REQUIREMENTS<br />
<br />
==== Bio ====<br />
<br />
TRAINING_3_TRAINER_BIO<br />
<br />
<!-- Fifth tab --><br />
= Conference Day =<br />
<br />
'''Conference Day is November 30th'''<br />
<br />
== Agenda (TBD)==<br />
<br />
{| class="wikitable"<br />
! width="120pt" | Time<br />
! width="190pt" | Speaker <br />
! width="400pt" | Topic<br />
! width="100pt" -- ! | Media<br />
|- <br />
| 08h30 - 09h00<br />
| colspan="3" style="text-align: center; background: grey; color: white" | ''Registration''<br />
|- <br />
| 09h00 - 09h15<br />
| colspan="3" style="text-align: center; background: grey; color: white" | ''Opening''<br />
|- <br />
| 09h15 - 10h00<br />
| [[#TALK_0915 | TALK_0915_PRESENTER]]<br />
| [[#TALK_0915 | TALK_0915_TITLE]]<br />
| not yet available <!--[[Media:TALK_0915_SLIDES|Slides]] [TALK_0915_VIDEO Video]--><br />
|-<br />
| 10h00 - 10h45<br />
| [[#TALK_1000 | TALK_1000_PRESENTER]]<br />
| [[#TALK_1000 | TALK_1000_TITLE]]<br />
| not yet available <!--[[Media:TALK_1000_SLIDES|Slides]] [TALK_1000_VIDEO Video]--><br />
|-<br />
| 10h45 - 11h15 <br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Morning Break'' <br />
|-<br />
| 11h15 - 12h00<br />
| [[#TALK_1115 | TALK_1115_PRESENTER]]<br />
| [[#TALK_1115 | TALK_1115_TITLE]]<br />
| not yet available <!--[[Media:TALK_1115_SLIDES|Slides]] [TALK_1115_VIDEO Video]--><br />
|-<br />
| 12h00 - 12h45<br />
| [[#TALK_1200 | TALK_1200_PRESENTER]]<br />
| [[#TALK_1200 | TALK_1200_TITLE]]<br />
| not yet available <!--[[Media:TALK_1200_SLIDES|Slides]] [TALK_1200_VIDEO Video]--><br />
|-<br />
| 12h45 - 13h45<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Lunch'' <br />
|-<br />
| 13h45 - 14h30<br />
| [[#TALK_1345 | TALK_1345_PRESENTER]]<br />
| [[#TALK_1345 | TALK_1345_TITLE]]<br />
| not yet available <!--[[Media:TALK_1345_SLIDES|Slides]] [TALK_1345_VIDEO Video]--><br />
|-<br />
| 14h30 - 15h15<br />
| [[#TALK_1430 | TALK_1430_PRESENTER]]<br />
| [[#TALK_1430 | TALK_1430_TITLE]]<br />
| not yet available <!--[[Media:TALK_1430_SLIDES|Slides]] [TALK_1430_VIDEO Video]--><br />
|-<br />
| 15h15 - 15h45<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Break'' <br />
|-<br />
| 15h45 - 16h30<br />
| [[#TALK_1545 | TALK_1545_PRESENTER]]<br />
| [[#TALK_1545 | TALK_1545_TITLE]]<br />
| not yet available <!--[[Media:TALK_1545_SLIDES|Slides]] [TALK_1545_VIDEO Video]--><br />
|-<br />
| 16h30 - 17h15<br />
| [[#TALK_1630 | TALK_1630_PRESENTER]]<br />
| [[#TALK_1630 | TALK_1630_TITLE]]<br />
| not yet available <!--[[Media:TALK_1630_SLIDES|Slides]] [TALK_1630_VIDEO Video]--><br />
|-<br />
| 17h15 - 17h30<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Closing'' <br />
|}<br />
<br />
== Talks == <br />
<br />
=== <span id="TALK_0915">TALK_0915_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
==== Bio ====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1000">TALK_1000_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
==== Bio ====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1115">TALK_1115_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
==== Bio ====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1200">TALK_1200_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
====Bio====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1345">TALK_1345_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
==== Bio ====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1430">TALK_1430_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
==== Bio ====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1545">TALK_1545_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
====Bio====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1630">TALK_1630_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
====Bio====<br />
<br />
TBD<br />
<br />
<!-- Sixth tab --><br />
= Social Event =<br />
<br />
'''The Social Event is on Thursday, November 29th'''<br />
<br />
'''If you want to join the social event, don't forget to register for it via the registration:'''<br />
<br />
<!--[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |200px|alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]] --><br />
<br />
Address: TBD<br />
<br />
Menu:TBD<br />
<br />
<!-- Seventh tab --><br />
= Sponsor =<br />
<br />
''' Become a sponsor of OWASP BeNeLux! '''<br />
<br />
There are 3 combined sponsorship packages (Gold, Silver or Bronze) that cover the BeNeLux chapter meetings 2019 and the BeNeLux OWASP Days 2018.<br />
<br />
Download our [https://www.owasp.org/images/8/8e/OWASP_BeNeLux_2018_Sponsorship_Form_v20181004.pdf sponsor brochure] and contact [mailto:seba@owasp.org us] for questions or sponsorship confirmation!<br />
<br />
Your sponsorship will be invested directly in the chapter meetings, supporting speaker and catering expenses. <br />
<br />
The sponsorship will also be dedicated to cover the costs of the OWASP 2018 BeNeLux event.<br />
<br />
<!-- Don't remove these two lines! -->__NOTOC__ <br />
<headertabs></headertabs><br />
<br />
=== Made possible by our {{#switchtablink:Sponsor|Sponsors}}===<br />
<br />
==== Hosted by ====<br />
<br />
TBD<br />
<br />
==== Platinum ====<br />
<br />
TBD<br />
<br />
==== Gold ====<br />
<br />
TBD<br />
<br />
==== Silver ====<br />
<br />
TBD<br />
<br />
==== Bronze ====<br />
<br />
TBD<br />
<br />
[[Category:OWASP_AppSec_Conference]] <br />
[[Category:OWASP_BeNeLux_Archives]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:OWASP_BeNeLux_2018_Sponsorship_Form_v20181004.pdf&diff=243984File:OWASP BeNeLux 2018 Sponsorship Form v20181004.pdf2018-10-04T05:04:34Z<p>Sdeleersnyder: </p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_BeNeLux-Days_2018&diff=243980OWASP BeNeLux-Days 20182018-10-04T05:00:21Z<p>Sdeleersnyder: </p>
<hr />
<div><center>[[Image:OBNL18 Banner v2.png]]</center><br />
<br />
<br><!-- Header --><br />
<br />
<br />
<!-- First tab --><br />
= Information =<br />
<br />
== Keynote Speaker ==<br />
<br />
{{#switchtablink:Conference Day|<p><br />
* TBD<br />
}}<br />
<br />
== Confirmed Conference Speakers ==<br />
<br />
{{#switchtablink:Conference Day|<p><br />
* TBD<br />
}}<br />
<br />
== Confirmed Trainers ==<br />
<br />
{{#switchtablink:Training Day|<p><br />
* TBD<br />
}}<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
<br />
== The OWASP BeNeLux Program Committee ==<br />
<br />
*Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium<br />
*Martin Knobloch / Joren Poll, OWASP Netherlands<br />
*Jocelyn Aubert, OWASP Luxembourg<br />
<br />
== Tweet! ==<br />
<br />
Event tag is [http://twitter.com/#search?q=%23owaspbnl17 #owaspbnl18]<br />
<br />
== Donate to OWASP BeNeLux ==<br />
<br />
[https://co.clickandpledge.com/?wid=72689 Donate]<br />
<br />
<!-- Second tab --><br />
= Registration =<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
<br />
<!--<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
--><br />
<br />
== OWASP BeNeLux training is reserved for OWASP members, and registration is required! ==<br />
<br />
To support the OWASP organisation, we ask training attendees to consider becoming an OWASP member, it's only US$50!<br />
Check out the [[Membership]] page to find out more. <br />
<br />
<!--<br />
[https://owasp-benelux-day-2018.eventbrite.com Register now!]<br />
--><br />
<br />
To support the OWASP organisation, consider to become a member, it's only US$50! Check out the [[Membership]] page to find out more. <br />
<br />
<!-- Third tab --><br />
= Venue =<br />
<br />
== Address ==<br />
<br />
Venue:<br />
<br />
'''Congres- en Erfgoedcentrum Lamot'''<br />
Van Beethovenstraat 8-10<br />
2800 Mechelen<br />
Belgium<br />
<br />
[https://goo.gl/maps/gZ9icR178w52 Google map]<br />
<br /><br />
[[File:Mechelen-Lamot.jpg|350px|Lamot conference center]]<br />
[[File:Mechelen-lamot-center-auditorium.jpg|350px|Auditorium]]<br /><br />
<br />
Parking:<br /><br />
[[File:Parking lots around Lamot Conference center Mechelen.png|500px|Parking facilities]]<br /><br />
[https://goo.gl/maps/Q5TD7hoTuUu Find your parking on Google Maps]<br />
<br />
=== How to reach the venue? ===<br />
<br />
==== Public transport ====<br />
<br />
You can reach the Mechelen's train station from Antwerpen or Brussels.<br />
The Lamot conference center is 10 min away by bus (line 1).<br />
<br />
Or you can choose to walk for 15 min (1.2 km).<br />
<br />
<br />
==== By car ====<br />
<br />
===== From Brussels: =====<br />
Follow the E19 Brussels / Antwerpen and take the exit 10. <br> Follow the N1 until the R12 (take a left) and turn to the right at the "Brusselpoort" into the Hoogstraat to reach one of the parkings.<br />
<br />
===== From Antwerpen: =====<br />
Follow the E19 Brussels / Antwerpen and take the exit 9. <br> Follow the N16 until the R12 (take a right) and turn to the left at the "Brusselpoort" into the Hoogstraat to reach one of the parkings. <br />
<br />
<br />
=== Hotels Nearby ===<br />
[https://www.google.com/maps/d/viewer?mid=1eYMYmwXKuAsTilKgpAtyYtfMA7A&ll=51.02648134397288%2C4.47819800000002&z=15 Hotels around the Lamot conference center]<br />
<br />
<!-- Fourth tab --><br />
= Training Day =<br />
<br />
'''Training Day is November 29th'''<br />
<br />
== Agenda (TBD)==<br />
<br />
{| class="wikitable"<br />
! Time !! Description !! Room TBA !! Room TBA !! Room TBA<br />
|-<br />
| 08h30 - 9h30<br />
| colspan="5" style="text-align: center; background: grey; color: white;" | ''Registration''<br />
|-<br />
| 09h30 - 11h00 || Training<br />
| rowspan="7" style="width:100px;" | [[#TRAINING_1 | TRAINING_1_TITLE]] by TRAINING_1_TRAINER<br />
| rowspan="7" style="width:100px;" | [[#TRAINING_2 | TRAINING_2_TITLE]] by TRAINING_2_TRAINER<br />
| rowspan="7" style="width:100px;" | [[#TRAINING_3 | TRAINING_3_TITLE]] by TRAINING_3_TRAINER<br />
|-<br />
| 11h00 - 11h30 || ''Coffee Break''<br />
|-<br />
| 11h30 - 13h00 || Training<br />
|-<br />
| 13h00 - 14h00 || ''Lunch''<br />
|-<br />
| 14h00 - 15h30 || Training<br />
|-<br />
| 15h30 - 16h00 || ''Coffee Break''<br />
|-<br />
| 16h00 - 17h30 || Training<br />
|}<br />
<br />
== Trainings ==<br />
<br />
=== <span id="TRAINING_1">TRAINING_1_TITLE by TRAINING_1_TRAINER</span> ===<br />
<br />
==== Topic(s) ====<br />
<br />
* TRAINING_1_TOPIC_1<br />
* TRAINING_1_TOPIC_2<br />
<br />
==== Keywords ====<br />
<br />
TRAINING_1_KEYWORD_1, TRAINING_1_KEYWORD_2<br />
<br />
==== Abstract ====<br />
<br />
TRAINING_1_ABSTRACT<br />
<br />
==== Requirements ====<br />
<br />
TRAINING_1_REQUIREMENTS<br />
<br />
==== Bio ====<br />
<br />
TRAINING_1_TRAINER_BIO<br />
<br />
=== <span id="TRAINING_2">TRAINING_2_TITLE by TRAINING_2_TRAINER</span> ===<br />
<br />
==== Topic(s) ====<br />
<br />
* TRAINING_2_TOPIC_1<br />
* TRAINING_2_TOPIC_2<br />
* ...<br />
<br />
==== Keywords ====<br />
<br />
TRAINING_2_KEYWORD_1, TRAINING_2_KEYWORD_2, ...<br />
<br />
==== Abstract ====<br />
<br />
TRAINING_2_ABSTRACT<br />
<br />
==== Requirements ====<br />
<br />
TRAINING_2_REQUIREMENTS<br />
<br />
==== Bio ====<br />
<br />
TRAINING_2_TRAINER_BIO<br />
<br />
=== <span id="TRAINING_3">TRAINING_3_TITLE by TRAINING_3_TRAINER</span> ===<br />
<br />
==== Topic(s) ====<br />
<br />
* TRAINING_3_TOPIC_1<br />
* TRAINING_3_TOPIC_2<br />
* ...<br />
<br />
==== Keywords ====<br />
<br />
TRAINING_3_KEYWORD_1, TRAINING_3_KEYWORD_2, ...<br />
<br />
==== Abstract ====<br />
<br />
TRAINING_3_ABSTRACT<br />
<br />
==== Requirements ====<br />
<br />
TRAINING_3_REQUIREMENTS<br />
<br />
==== Bio ====<br />
<br />
TRAINING_3_TRAINER_BIO<br />
<br />
<!-- Fifth tab --><br />
= Conference Day =<br />
<br />
'''Conference Day is November 30th'''<br />
<br />
== Agenda (TBD)==<br />
<br />
{| class="wikitable"<br />
! width="120pt" | Time<br />
! width="190pt" | Speaker <br />
! width="400pt" | Topic<br />
! width="100pt" -- ! | Media<br />
|- <br />
| 08h30 - 09h00<br />
| colspan="3" style="text-align: center; background: grey; color: white" | ''Registration''<br />
|- <br />
| 09h00 - 09h15<br />
| colspan="3" style="text-align: center; background: grey; color: white" | ''Opening''<br />
|- <br />
| 09h15 - 10h00<br />
| [[#TALK_0915 | TALK_0915_PRESENTER]]<br />
| [[#TALK_0915 | TALK_0915_TITLE]]<br />
| not yet available <!--[[Media:TALK_0915_SLIDES|Slides]] [TALK_0915_VIDEO Video]--><br />
|-<br />
| 10h00 - 10h45<br />
| [[#TALK_1000 | TALK_1000_PRESENTER]]<br />
| [[#TALK_1000 | TALK_1000_TITLE]]<br />
| not yet available <!--[[Media:TALK_1000_SLIDES|Slides]] [TALK_1000_VIDEO Video]--><br />
|-<br />
| 10h45 - 11h15 <br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Morning Break'' <br />
|-<br />
| 11h15 - 12h00<br />
| [[#TALK_1115 | TALK_1115_PRESENTER]]<br />
| [[#TALK_1115 | TALK_1115_TITLE]]<br />
| not yet available <!--[[Media:TALK_1115_SLIDES|Slides]] [TALK_1115_VIDEO Video]--><br />
|-<br />
| 12h00 - 12h45<br />
| [[#TALK_1200 | TALK_1200_PRESENTER]]<br />
| [[#TALK_1200 | TALK_1200_TITLE]]<br />
| not yet available <!--[[Media:TALK_1200_SLIDES|Slides]] [TALK_1200_VIDEO Video]--><br />
|-<br />
| 12h45 - 13h45<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Lunch'' <br />
|-<br />
| 13h45 - 14h30<br />
| [[#TALK_1345 | TALK_1345_PRESENTER]]<br />
| [[#TALK_1345 | TALK_1345_TITLE]]<br />
| not yet available <!--[[Media:TALK_1345_SLIDES|Slides]] [TALK_1345_VIDEO Video]--><br />
|-<br />
| 14h30 - 15h15<br />
| [[#TALK_1430 | TALK_1430_PRESENTER]]<br />
| [[#TALK_1430 | TALK_1430_TITLE]]<br />
| not yet available <!--[[Media:TALK_1430_SLIDES|Slides]] [TALK_1430_VIDEO Video]--><br />
|-<br />
| 15h15 - 15h45<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Break'' <br />
|-<br />
| 15h45 - 16h30<br />
| [[#TALK_1545 | TALK_1545_PRESENTER]]<br />
| [[#TALK_1545 | TALK_1545_TITLE]]<br />
| not yet available <!--[[Media:TALK_1545_SLIDES|Slides]] [TALK_1545_VIDEO Video]--><br />
|-<br />
| 16h30 - 17h15<br />
| [[#TALK_1630 | TALK_1630_PRESENTER]]<br />
| [[#TALK_1630 | TALK_1630_TITLE]]<br />
| not yet available <!--[[Media:TALK_1630_SLIDES|Slides]] [TALK_1630_VIDEO Video]--><br />
|-<br />
| 17h15 - 17h30<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Closing'' <br />
|}<br />
<br />
== Talks == <br />
<br />
=== <span id="TALK_0915">TALK_0915_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
==== Bio ====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1000">TALK_1000_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
==== Bio ====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1115">TALK_1115_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
==== Bio ====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1200">TALK_1200_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
====Bio====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1345">TALK_1345_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
==== Bio ====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1430">TALK_1430_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
==== Bio ====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1545">TALK_1545_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
====Bio====<br />
<br />
TBD<br />
<br />
=== <span id="TALK_1630">TALK_1630_TITLE</span> ===<br />
<br />
==== Abstract ====<br />
<br />
TBD<br />
<br />
====Bio====<br />
<br />
TBD<br />
<br />
<!-- Sixth tab --><br />
= Social Event =<br />
<br />
'''The Social Event is on Thursday, November 29th'''<br />
<br />
'''If you want to join the social event, don't forget to register for it via the registration:'''<br />
<br />
<!--[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |200px|alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]] --><br />
<br />
Address: TBD<br />
<br />
Menu:TBD<br />
<br />
<!-- Seventh tab --><br />
= Sponsor =<br />
<br />
''' Become a sponsor of OWASP BeNeLux! '''<br />
<br />
There are 3 combined sponsorship packages (Gold, Silver or Bronze) that cover the BeNeLux chapter meetings 2019 and the BeNeLux OWASP Days 2018.<br />
<br />
Download our [https://www.owasp.org/images/a/a9/OWASP_BeNeLux_2018_Sponsorship_Form_v20180919.pdf sponsor brochure] and contact [mailto:seba@owasp.org us] for questions or sponsorship confirmation!<br />
<br />
Your sponsorship will be invested directly in the chapter meetings, supporting speaker and catering expenses. <br />
<br />
The sponsorship will also be dedicated to cover the costs of the OWASP 2018 BeNeLux event.<br />
<br />
<!-- Don't remove these two lines! -->__NOTOC__ <br />
<headertabs></headertabs><br />
<br />
=== Made possible by our {{#switchtablink:Sponsor|Sponsors}}===<br />
<br />
==== Hosted by ====<br />
<br />
TBD<br />
<br />
==== Platinum ====<br />
<br />
TBD<br />
<br />
==== Gold ====<br />
<br />
TBD<br />
<br />
==== Silver ====<br />
<br />
TBD<br />
<br />
==== Bronze ====<br />
<br />
TBD<br />
<br />
[[Category:OWASP_AppSec_Conference]] <br />
[[Category:OWASP_BeNeLux_Archives]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:OBNL18_Banner_v2.png&diff=243979File:OBNL18 Banner v2.png2018-10-04T04:59:44Z<p>Sdeleersnyder: </p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:Header-BNL-2018.png&diff=243978File:Header-BNL-2018.png2018-10-04T04:58:06Z<p>Sdeleersnyder: Sdeleersnyder uploaded a new version of File:Header-BNL-2018.png</p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:Header-BNL-2018.png&diff=243977File:Header-BNL-2018.png2018-10-04T04:57:23Z<p>Sdeleersnyder: Sdeleersnyder uploaded a new version of File:Header-BNL-2018.png</p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:Header-BNL-2018.png&diff=243976File:Header-BNL-2018.png2018-10-04T04:56:29Z<p>Sdeleersnyder: Sdeleersnyder uploaded a new version of File:Header-BNL-2018.png</p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_BeNeLux-Days_2018&diff=243526OWASP BeNeLux-Days 20182018-09-19T13:03:23Z<p>Sdeleersnyder: </p>
<hr />
<div><center>[[Image:Header-BNL-2018.png]]<br></center><br />
<br />
<br><!-- Header --><br />
<br />
<br />
<!-- First tab --><br />
= Information =<br />
== Keynote speaker ==<br />
{{#switchtablink:Conferenceday|<p><br />
* TBD<br />
}}<br />
<br />
== Confirmed speakers Conference ==<br />
{{#switchtablink:Conferenceday|<p><br />
* TBD<br />
}}<br />
<br />
== Confirmed trainers ==<br />
{{#switchtablink:Trainingday|<p><br />
* TBD<br />
}}<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
<br />
== The OWASP BeNeLux Program Committee ==<br />
*Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium<br />
*Martin Knobloch / Joren Poll, OWASP Netherlands<br />
*Jocelyn Aubert, OWASP Luxembourg<br />
<br><br />
<br />
== Tweet! ==<br />
Event tag is [http://twitter.com/#search?q=%23owaspbnl17 #owaspbnl18]<br />
<br><br><br />
== Donate to OWASP BeNeLux ==<br />
[https://co.clickandpledge.com/?wid=72689 Donate]<br />
<br />
<!-- Second tab --><br />
<br />
= Registration =<br />
<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
<!--<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
--><br />
<br />
== OWASP BeNeLux training is reserved for OWASP members, and registration is required! ==<br />
To support the OWASP organisation, we ask training attendees to consider becoming an OWASP member, it's only US$50!<br />
Check out the [[Membership]] page to find out more. <br />
<br />
<!--<br />
[https://owasp-benelux-day-2018.eventbrite.com Register now!]<br />
--><br />
<br><br />
To support the OWASP organisation, consider to become a member, it's only US$50!<br />
<br> <br />
Check out the [[Membership]] page to find out more. <br />
<br><br />
<br />
<br />
<!-- Third tab --><br />
<br />
= Venue =<br />
<br />
== Venue ==<br />
<br />
<br />
The venue is located:<br />
<br />
'''Congres- en Erfgoedcentrum Lamot'''<br />
:Van Beethovenstraat 8-10<br />
:B – 2800 Mechelen<br />
:Belgium<br />
:[https://goo.gl/maps/gZ9icR178w52 Google map]<br />
<br />
'''''Parking .....'''''<br />
<br />
=== How to reach the venue? ===<br />
;'''Public transport '''<br><br />
TBD<br />
<br />
'''<u>By car</u>'''<br />
TBD<br />
<br />
=== Hotel nearby ===<br />
[https://www.google.nl/maps/search/Hotels/@51.5571525,5.0821866,15z/data=!3m1!4b1 Hotels on Google Maps]<br />
<!-- Fourth tab --><br />
<br />
= Trainingday =<br />
=== Trainingday is November 29rd ===<br />
<br />
== Location ==<br />
<br />
== Agenda (TBD)==<br />
{| class="wikitable"<br />
! Time !! Description !! Room TBA !! Room TBA !! Room TBA<br />
|-<br />
| 08h30 - 9h30<br />
| colspan="5" style="text-align: center; background: grey; color: white;" | ''Registration''<br />
|-<br />
| 09h30 - 11h00 || Training<br />
| rowspan="7" style="width:100px;" | [[OWASP_BeNeLux-Day_2017#WebGoat_-_Teaching_application_security_101_by_Nanne_Baars | WebGoat - Teaching application security 101]] <br>by [[OWASP_BeNeLux-Day_2017#WebGoat_-_Teaching_application_security_101_by_Nanne_Baars | Nanne Baars]]<br />
| rowspan="7" style="width:100px;" | [[OWASP_BeNeLux-Day_2017#Whiteboard_Hacking_aka_Hands-on_Threat Modeling_by_Sebastien Deleersnyder | Whiteboard Hacking aka Hands-on Threat Modeling]] <br>by [[OWASP_BeNeLux-Day_2017#Whiteboard_Hacking_aka_Hands-on_Threat Modeling_by_Sebastien Deleersnyder | Sebastien Deleersnyder]]<br />
| rowspan="7" style="width:100px;" | [[OWASP_BeNeLux-Day_2017#Secure_Development:_Models_and_best_practices_by_Bart_De_Win | Secure Development: Models and best practices]] <br>by [[OWASP_BeNeLux-Day_2017#Secure_Development:_Models_and_best_practices_by_Bart_De_Win | Bart De Win]]<br />
|-<br />
| 11h00 - 11h30 || ''Coffee Break''<br />
|-<br />
| 11h30 - 13h00 || Training<br />
|-<br />
| 13h00 - 14h00 || ''Lunch''<br />
|-<br />
| 14h00 - 15h30 || Training<br />
|-<br />
| 15h30 - 16h00 || ''Coffee Break''<br />
|-<br />
| 16h00 - 17h30 || Training<br />
|}<br />
<br />
== Trainings ==<br />
=== WebGoat - Teaching application security 101 by Nanne Baars ===<br />
====Topic(s) ====<br />
* Web Application Breaker<br />
* Other<br />
====Keywords ====<br />
WebGoat application, security teaching secure development<br />
<br />
====Abstract ====<br />
A good defense against insecure code requires understanding the mechanics behind how attackers exploit simple programming mistakes.<br />
The WebGoat team will walk through exercises like SQL Injection, XSS, XXE, CSRF, ... and demonstrate how these exploits work.<br />
<br />
We will show you how you can use WebGoat to train your developers to avoid these simple but common programming mistakes.<br />
<br />
We also show you how to extend WebGoat to create lessons specific to your environment.<br />
Join us to learn the most basic, but common, application security problems.<br />
<br />
Tired of all the lessons? During the training we will host a small CTF competition which you can take a shot at and compete with each other...<br />
<br />
=== Requirements===<br />
Please find the course prerequisites here: https://github.com/nbaars/owasp-training<br />
<br />
====Bio====<br />
Nanne Baars works as a security consultant & developer at JDriven and is one of the primary developers of WebGoat.<br />
<br />
=== Whiteboard Hacking aka Hands-on Threat Modeling by Sebastien Deleersnyder ===<br />
====Topic(s) ====<br />
* Threat modeling introduction<br />
* Diagrams – what are you building?<br />
* Identifying threats – what can go wrong?<br />
* Hands-on: STRIDE analysis of an Internet of Things (IoT) deployment with an on premise gateway and secure update service<br />
* Addressing each threats<br />
* Hands-on: threat mitigations OAuth scenarios for web and mobile applications<br />
<br />
====Keywords ====<br />
Threat Modeling, STRIDE, Technical risk assessment<br />
<br />
====Abstract ====<br />
This is a one day version of our Black Hat training on Threat Modeling. The students will be challenged to perform practical threat modeling in groups of 3 to 4 people covering the different stages of threat modeling on:<br />
* An Internet of Things (IoT) deployment with an on premise gateway and secure update service<br />
* An HR services OAuth scenario for mobile and web applications <br />
Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. It also allows consideration of security issues at the component or application level. The threat modeling course will teach you to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model. <br><br />
This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications, databases & Single sign on (SSO) principles.<br />
<br />
<br />
====Bio====<br />
Sebastien (lead application security consultant Toreon) led engagements in the domain of ICT-security, Web and Mobile Security with several customers in the private and public sector. Sebastien is the Belgian OWASP Chapter Leader and is co-project leader of OWASP SAMM.<br />
<br />
=== Secure Development: Models and best practices by Bart De Win ===<br />
====Topic(s) ====<br />
* Software Assurance maturity models<br />
* Secure Development in agile development<br />
* Tips and tricks for practical SDLC<br />
* Hands-on: SAMM analysis of your enterprise using SAMM 1.5<br />
* Sneak preview of SAMM 2.0<br />
<br />
====Keywords ====<br />
SDLC, SAMM, Agile development, <br />
<br />
====Abstract ====<br />
It takes much more than a good developer to build secure software within an organisation. Indeed, building secure software is about ensuring that security is taken into consideration during the entire software lifecycle. It is about ensuring that security best practices are being employed efficiently, and that uncovered risks are appropriately dealt with in due time.<br />
<br />
During this one-day training, we will introduce and discuss different secure development approaches and models. We will look into waterfall vs. agile development and discuss different strategies to successfully run an SDLC program. Finally, we will also put theorie into practice and take your organisation to perform a mini SDLC assessment and improvement exercise.<br />
[[File:Benelux2017 - Secure Development Training deck.pdf|thumb]]<br />
The slides of this session are available for download in the media file.<br />
<br />
====Bio====<br />
Bart is an application security consultant and enthousiast and is spending considerable time on secure development projects. Bart is board member of the Belgian OWASP Chapter and is co-project leader of OWASP SAMM.<br />
<br />
<br />
<!-- Fifth tab --><br />
<br />
= Conferenceday =<br />
=== Conferenceday is November 30th ===<br />
<br />
<br />
== Agenda (TBD)==<br />
{| class="wikitable"<br />
! width="120pt" | Time<br />
! width="190pt" | Speaker <br />
! width="400pt" | Topic<br />
! width="100pt" -- ! | Media<br />
|- <br />
| 08h30 - 09h00<br />
| colspan="3" style="text-align: center; background: grey; color: white" | ''Registration''<br />
|- <br />
| 09h00 - 09h15<br />
| colspan="3" style="text-align: center; background: grey; color: white" | ''Opening''<br />
|- <br />
| 09h15 - 10h00 || [[OWASP_BeNeLux-Day_2017#Attribute Based Access Control. Why, what, how? by Jacoba Sieders | Jacoba Sieders]]<br />
|| [[OWASP_BeNeLux-Day_2017#Attribute Based Access Control. Why, what, how? by Jacoba Sieders | Attribute Based Access Control. Why, what, how?]] <br />
|| [[Media:OWASP BeNeLux-Day 2017 AttributeBasedAccessControl WhyWhatHow JacobaSieders.pdf|Slides]]<br>[https://youtu.be/O7iWITnZGsk Video]<br />
|-<br />
| 10h00 - 10h45 || [[OWASP_BeNeLux-Day_2017#How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil by Matia Madou | Matias Madou]]<br />
|| [[OWASP_BeNeLux-Day_2017#How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil by Matia Madou | How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil]]<br />
|| [[Media:OWASP_BeNeLux-Day_2017_how_to_spend_$3.6_mil_on_one_coding_mistake_by_Matias_Madou.pdf|Slides]] <br> [https://www.youtube.com/watch?v=dt5rFGBztJA&feature=youtu.be Video]<br />
<br />
|-<br />
| 10h45 - 11h15 <br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Morning Break'' <br />
|-<br />
| 11h15 - 12h00 || [[OWASP_BeNeLux-Day_2017#The evil friend in your browser by Achim D. Brucker | Achim D. Brucker]]<br />
|| [[OWASP_BeNeLux-Day_2017#The evil friend in your browser by Achim D. Brucker | The evil friend in your browser]]<br />
| [[Media:OWASP_BeNeLux-Day_2017_The evil friend in your browser_Achim_Brucker.pdf|Slides]]<br>[https://www.youtube.com/watch?v=_Uj-Ci37Rvw&feature=youtu.be Video]<br />
|-<br />
| 12h00 - 12h45 || [[OWASP_BeNeLux-Day_2017#Exploring the ecosystem of malicious domain registrations in the .eu TLD by Lieven Desmet | Lieven Desmet]]<br />
|| [[OWASP_BeNeLux-Day_2017#Exploring the ecosystem of malicious domain registrations in the .eu TLD by Lieven Desmet | Exploring the ecosystem of malicious domain registrations in the .eu TLD]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Exploring the ecosystem of malicious domain registrations LievenDesmet.pdf|Slides]]<br>[https://www.youtube.com/watch?v=09SNSYHw8H0&feature=youtu.be Video]<br />
|-<br />
| 12h45 - 13h45<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Lunch'' <br />
|-<br />
| 13h45 - 14h30 || [[OWASP_BeNeLux-Day_2017#Don't trust the DOM: Bypassing XSS mitigations via script gadgets by Sebastian Lekies | Sebastian Lekies]]<br />
|| [[OWASP_BeNeLux-Day_2017#Don't trust the DOM: Bypassing XSS mitigations via script gadgets by Sebastian Lekies | Don't trust the DOM: Bypassing XSS mitigations via script gadgets]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Bypassing XSS mitigations via script gadgets Sebastian Lekies.pdf|Slides]]<br>[https://www.youtube.com/watch?v=rssg--FP1AE&feature=youtu.be Video]<br />
|-<br />
| 14h30 - 15h15 || [[OWASP_BeNeLux-Day_2017#A Series of Unfortunate Events: Where Malware Meets Murphy by Mattijs van Ommeren | Mattijs van Ommeren]]<br />
|| [[OWASP_BeNeLux-Day_2017#A Series of Unfortunate Events: Where Malware Meets Murphy by Mattijs van Ommeren | A Series of Unfortunate Events: Where Malware Meets Murphy]]<br />
| <!--[[Media:OWASP_Benelux-Day_2017_A_Series_Of_Unfortunate_Events-Where_Malware_Meets_Murphy_Mattijs_van_Ommeren.pdf|Slides]]<br> -->[https://www.youtube.com/watch?v=d67yxt3FdTA&feature=youtu.be Video]<br />
|-<br />
| 15h15 - 15h45<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Break'' <br />
|-<br />
| 15h45 - 16h30 || [[OWASP_BeNeLux-Day_2017#Common REST API security pitfalls by Philippe De Ryck | Philippe De Ryck]]<br />
|| [[OWASP_BeNeLux-Day_2017#Common REST API security pitfalls by Philippe De Ryck | Common REST API security pitfalls]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Common REST API security pitfalls Philippe De Ryck.pdf|Slides]]<br>[https://www.youtube.com/watch?v=Meh4EUmLCfM&feature=youtu.be Video]<br />
|-<br />
| 16h30 - 17h15 || [[OWASP_BeNeLux-Day_2017#Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded by Jeroen Willemsen | Jeroen Willemsen]]<br />
|| [[OWASP_BeNeLux-Day_2017#Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded by Jeroen Willemsen | Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded Jeroen Willemsen.pdf|Slides]]<br>[https://www.youtube.com/watch?v=Q3q1mdev5rs&feature=youtu.be Video]<br />
|-<br />
| 17h15 - 17h30<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Closing'' <br />
|}<br />
<br />
<div id="TBD"></div><br />
<br />
== Talks == <br />
<br />
===Attribute Based Access Control. Why, what, how? by Jacoba Sieders===<br />
====Abstract====<br />
Digitization is rapidly transforming the traditional world and regulation on security and data protection is gaining weight. Digital identity, but also data protection become crucial capabilities for businesses. What are the trends in IAM and what role can Attribute Based Access Control (ABAC) play here? ABNAMRO started implementing ABAC in 2014. What were the approach and the lessons learnt?<br />
====Bio====<br />
Jacoba Sieders, Head of Digital Identity- & Access, ABNAMRO Bank.<br /><br />
Jacoba is an all-round Digital Identity and Information Security expert with 17 years of experience in the international finance industry, in technology, governance, consultancy, and implementation. She is accountable for digital identity services and access control for customers, employees and partners to the bank’s data and infrastructure. <br />
Major topics on her agenda today are ABAC, data centric security, API-banking and PSDII requirements, the interaction of IAM tools with the rest of the bank’s cybersecurity landscape, and the new authentication concept for which ABNAMRO is acquiring a patent. Her special interests are legal requirements impacting identity, e.g. Generic Data Protection Regulation, the EU e-IDAS scheme, KYC and AML legislation. <br />
Jacoba is a member of the Advisory Board of the independent European think-tank ID Next and is regularly speaking on the topic of IAM. She holds a master degree in Classics from Leiden University (Greek, Latin, Hebrew). <br />
<br />
<br />
===How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil by Matia Madou===<br />
====Abstract====<br />
In a recent global study, the average cost of a data breach is $3.62M globally. This session will discuss infamous examples of data breaches that has made headlines around the world. We will explore the technical details of the vulnerability itself and what a coding solution may have been to prevent the breach. We will also dive deeper on exploring different solutions, processes and techniques you can apply in your day-to-day to prevent application security vulnerabilities in your code.<br />
====Bio====<br />
Matias Madou is a Co-Founder and CTO of Secure Code Warrior where he is responsible for leading the company’s technology vision and overseeing the engineering team. Matias has more than 15 years of hands-on software security experience and has developed solution for companies such as HP Fortify, and founded a company called Sensei Security. Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon. Matias holds a Ph.D. in Computer Engineering from Ghent University.<br />
<br />
<br />
===The evil friend in your browser by Achim D. Brucker===<br />
====Abstract====<br />
On the one hand, browser extensions, e.g., for Chrome, are very useful, as they extend web browsers with additional functionality<br />
(e.g., blocking ads). On the other hand, they are the most dangerous code that runs in your browsers: extension can read and modify both the content displayed in the browser. As they also can communicate with any web-site or web-service, they can report both data and metadata to external parties.<br />
<br />
The current security model for browser extensions seems to be inadequate for expressing the security or privacy needs of browser users. Consequently, browser extensions are a "juice target" for attackers targeting web users.<br />
<br />
We present results of analysing over 60000 browser extensions on how they use the current security model and discuss examples of extensions that are potentially of high risk. Based on the results of our analysis of real world browser extensions as well as our own threat model, we discuss the limitations of the current security model form a user perspective. need of browser users.<br />
<br />
====Bio====<br />
Dr. Achim D. Brucker (www.brucker.uk) is a Senior Lecturer and consultant for software and systems assurance at the Computer Science Department of The University of Sheffield, UK. Until December 2015, he was a Research Expert (Architect), Security Testing Strategist, and Project Lead in the Global Security Team of SAP SE, where he defined the risk-based security testing strategy of SAP that combines static, dynamic, and interactive security testing methods and integrates them deeply into SAP's Secure Software Development Lifecycle. He has experience in rolling out *AST tools to world-wide development organisations.<br />
<br />
===Exploring the ecosystem of malicious domain registrations in the .eu TLD by Lieven Desmet===<br />
====Abstract====<br />
In this talk, we report on an extensive analysis of 14 months of domain registration in the .eu TLD. The purpose is to identify large-scale malicious campaigns. Overall, the dataset of this study contains 824,121 new domain registrations; 2.53% of which have been flagged as malicious by blacklisting services. We explore the ecosystem and modus operandi of elaborate cybercriminal entities that recurrently register large amounts of domains for one-shot, malicious use. Although these malicious domains are short-lived, we establish that at least 80.04% of them can be framed in to 20 larger campaigns with varying duration and intensity. We further report on insights in the operational aspects of this business and observe, amongst other findings, that their processes are only partially automated. <br />
====Bio====<br />
Lieven Desmet is a Senior Research Manager on Secure Software in the imec-DistriNet Research Group at the Katholieke Universiteit Leuven (Belgium), where he outlines and implements the research strategy, coaches junior researchers in application security, and participates in dissemination, valorisation and spin-off activities. Lieven is also involved in OWASP as a board member of the Belgium OWASP Chapter, and part of the organisation team of the OWASP BeNeLux Day.<br />
<br />
===Don't trust the DOM: Bypassing XSS mitigations via script gadgets by Sebastian Lekies===<br />
====Abstract====<br />
Cross-Site Scripting is a constant problem of the Web platform. Over the years many techniques have been introduced to prevent or mitigate XSS. Most of these techniques, thereby, focus on script tags and event handlers. HTML sanitizers, for example, aim at removing potentially dangerous tags and attributes. Another example is the Content Security Policy, which forbids inline event handlers and aims at white listing of legitimate scripts.<br />
<br />
In this talk, we present a novel Web hacking technique that enables an attacker to circumvent most XSS mitigations. In order to do so, the attacker abuses so-called script gadgets. A script gadget Is a legitimate piece of JavaScript in a page that reads elements from the DOM via selectors and processes them in a way that results in script execution. To abuse a script gadget, the attacker injects a benign looking element into the page that matches the gadget's selector. Subsequently, the gadget selects the benign-looking element and executes attacker-controlled scripts. As the initially injected element is benign it passes HTML sanitizers and security policies. The XSS only surfaces when the gadget mistakenly elevates the privileges of the element.<br />
<br />
In this talk, we will demonstrate that these gadgets are present in almost all modern JavaScript libraries, APIs and applications. We will present several case studies and real-world examples that demonstrate that many mitigation techniques are not suited for modern applications. As a result, we argue that the Web should start focusing more on preventive mechanisms instead of mitigations.<br />
====Bio====<br />
Sebastian Lekies is tech leading the Web application security scanning team at Google. Before joining Google, he was part of SAP's Security Research team, where he conducted academic research in the area of client-side Web application security. Sebastian is regularly speaking at academic and non-academic security conferences such as BlackHat US/EU/Asia, DeepSec, OWASP AppSec EU, Usenix Security, CCS, and many more...<br />
<br />
<br />
===A Series of Unfortunate Events: Where Malware Meets Murphy by Mattijs van Ommeren===<br />
====Abstract====<br />
When an end user reports some “strange looking file names”, which, after investigating, you discover include several hundreds of Gigabytes of encrypted data, you of course know you are going to have a bad day. Your AV solution has failed you, your firewall has failed you, and your SIEM has failed you. Basically, every piece of security infrastructure you have put your trust (and money) into has left you out in the cold and you thank <deity of choice> that at least the nightly backup was completed successfully. Spin up the tape drive, and soon you will be back in business, or not…?<br />
<br />
This talk is about failure. Not only about a failing security infrastructure, but also about failure in doing the Right Thing™ as a first responder, about the failure of Operating System tools, failing APIs, and ironically, also the failure of malware (which is unfortunately not as positive as it may sound). The scenario presented comes pretty close to the worst chain of events you can imagine, in an attempt to recover from a ransomware incident.<br />
<br />
Luckily – this story has a happy ending. We will reveal how one can be prepared for when both Count Olaf and Murphy come knocking on your door simultaneously.<br />
====Bio====<br />
Mattijs van Ommeren has been poking hardware and software for 15 years. He has spent most of his working life as a security consultant, attacking and defending both traditional IT environments as well as more esoteric embedded devices and industrial systems. Presently he has a lot of fun at Nixu.<br />
<br />
<br />
===Common REST API security pitfalls by Philippe De Ryck===<br />
====Abstract====<br />
The shift towards a REST API landscape indicates a significant evolution in the way we build applications. The rise of JavaScript and mobile applications have sparked an explosion of easily-accessible REST APIs. But how do you protect access to your API? Which security aspects are no longer relevant? Which security features are an absolutely must-have, and which additional security measures do you need to take into account?<br />
<br />
These are hard questions, as evidenced by the deployment of numerous insecure REST APIs. Attend this session to find out about common API security pitfalls, that often result in compromised user accounts and unauthorized access to your data. We expose the problem that lies at the root of each of these pitfalls, and offer actionable advice to address these security problems. After this session, you will know how to assess the security of your APIs, and the best practices to improve them towards the future.<br />
====Bio====<br />
Philippe De Ryck is a professional speaker and trainer on software security and web security. Since he obtained his PhD at the imec-DistriNet research group (KU Leuven, Belgium), he has been running the group's Web Security Training program, which ensures a sustainable knowledge transfer of the group’s security expertise towards practitioners.<br />
<br />
<br />
===Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded by Jeroen Willemsen===<br />
====Abstract====<br />
Join us on our adventure of setting up a appsec pipeline with Docker containers. What did go wrong, how did we succeed? How do you fight false positives and how do you get the best out of the products out there without bothering the development teams too much.<br />
====Bio====<br />
Jeroen Willemsen is a security architect with a passion for mobile and risk management. He loves to work on secure building blocks, security automation pipelines and embedding information security risk management controls in an agile environment. He is dedicated to help developers, product owners and architects to take security seriously in their daily development life (but not too serious of course ;-)).In his spare time he loves to experiment with new technologies and frameworks.”<br />
<br />
<br />
<!-- Sixth tab --><br />
<br />
= Social Event (TBD)=<br />
<br />
== Social Event,starting at 7PM ==<br />
Thursday, November 23rd<br />
;Dudok Tilburg<br />
:Veemarktstraat 33<br />
:5038 CT Tilburg<br />
:http://www.dudok.nl/<br />
Menu:<br />
:As we are a big group, Dudok will prepare the following [[Media:Dudok menu OWASP.pdf|menu]] for us!<br />
'''If you want to join the social event, don't forget to register for the social event via the registration:'''<br />
:[[image:Register_now_red.png|link=https://owasp-benelux-day-2017.eventbrite.com |200px|alt=Register for the OWASP BeNeLux Day 2017 | Register for the OWASP BeNeLux Day 2017 ]]<br />
<br />
<br />
(limited) open tap sponsored by :<br />
[[File:Avi Logo Transparent Background 300pix.png|200px|link=https://avinetworks.com/]] <br />
<br />
<!-- Seventh tab --><br />
<br />
= Sponsor =<br />
<br />
=== Become a sponsor of OWASP BeNeLux ===<br />
<br />
There are 3 combined sponsorship packages (Gold, Silver or Bronze) that cover the BeNeLux chapter meetings 2019 and the BeNeLux OWASP Days 2018.<br />
<br />
Download our [https://www.owasp.org/images/a/a9/OWASP_BeNeLux_2018_Sponsorship_Form_v20180919.pdf sponsor brochure] and contact [mailto:seba@owasp.org us] for questions or sponsorship confirmation!<br />
<br />
Your sponsorship will be invested directly in the chapter meetings, supporting speaker and catering expenses. <br />
<br />
The sponsorship will also be dedicated to cover the costs of the OWASP 2018 BeNeLux event.<br />
<br />
<!-- Don't remove these two lines! -->__NOTOC__ <br />
<headertabs></headertabs><br />
<br />
=== Made possible by our {{#switchtablink:Sponsor|Sponsors}}===<br />
'''Hosted by'''<br />
<br />
<br />
'''Platinum:'''<br />
<br />
<br />
'''Gold:'''<br />
<br />
<br />
'''Silver:'''<br />
<br />
<br />
'''Bronze:'''<br />
<br />
<br />
[[Category:OWASP_AppSec_Conference]] <br />
[[Category:OWASP_BeNeLux_Archives]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_BeNeLux-Days_2018&diff=243525OWASP BeNeLux-Days 20182018-09-19T12:58:00Z<p>Sdeleersnyder: /* Become a sponsor of OWASP BeNeLux */</p>
<hr />
<div><center>[[Image:Header-BNL-2018.png]]<br></center><br />
<br />
<br><!-- Header --><br />
<br />
<br />
<!-- First tab --><br />
= Information =<br />
== Keynote speaker ==<br />
{{#switchtablink:Conferenceday|<p><br />
* TBD<br />
}}<br />
<br />
== Confirmed speakers Conference ==<br />
{{#switchtablink:Conferenceday|<p><br />
* TBD<br />
}}<br />
<br />
== Confirmed trainers ==<br />
{{#switchtablink:Trainingday|<p><br />
* TBD<br />
}}<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
<br />
== The OWASP BeNeLux Program Committee ==<br />
*Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium<br />
*Martin Knobloch / Joren Poll, OWASP Netherlands<br />
*Jocelyn Aubert, OWASP Luxembourg<br />
<br><br />
<br />
== Tweet! ==<br />
Event tag is [http://twitter.com/#search?q=%23owaspbnl17 #owaspbnl18]<br />
<br><br><br />
== Donate to OWASP BeNeLux ==<br />
[https://co.clickandpledge.com/?wid=72689 Donate]<br />
<br />
<!-- Second tab --><br />
<br />
= Registration =<br />
<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
<!--<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
--><br />
<br />
== OWASP BeNeLux training is reserved for OWASP members, and registration is required! ==<br />
To support the OWASP organisation, we ask training attendees to consider becoming an OWASP member, it's only US$50!<br />
Check out the [[Membership]] page to find out more. <br />
<br />
<!--<br />
[https://owasp-benelux-day-2018.eventbrite.com Register now!]<br />
--><br />
<br><br />
To support the OWASP organisation, consider to become a member, it's only US$50!<br />
<br> <br />
Check out the [[Membership]] page to find out more. <br />
<br><br />
<br />
<br />
<!-- Third tab --><br />
<br />
= Venue =<br />
<br />
== Venue ==<br />
<br />
<br />
The venue is located:<br />
<br />
:'''TBD''' <br />
:TBD<br />
:TBD<br />
:Belgium<br />
:[https://goo.gl/maps/5CJYYSMAJD92 Google map]<br />
<br />
'''''Parking .....'''''<br />
<br />
=== How to reach the venue? ===<br />
;'''Public transport '''<br><br />
TBD<br />
<br />
'''<u>By car</u>'''<br />
TBD<br />
<br />
=== Hotel nearby ===<br />
[https://www.google.nl/maps/search/Hotels/@51.5571525,5.0821866,15z/data=!3m1!4b1 Hotels on Google Maps]<br />
<!-- Fourth tab --><br />
<br />
= Trainingday =<br />
=== Trainingday is November 29rd ===<br />
<br />
== Location ==<br />
<br />
== Agenda (TBD)==<br />
{| class="wikitable"<br />
! Time !! Description !! Room TBA !! Room TBA !! Room TBA<br />
|-<br />
| 08h30 - 9h30<br />
| colspan="5" style="text-align: center; background: grey; color: white;" | ''Registration''<br />
|-<br />
| 09h30 - 11h00 || Training<br />
| rowspan="7" style="width:100px;" | [[OWASP_BeNeLux-Day_2017#WebGoat_-_Teaching_application_security_101_by_Nanne_Baars | WebGoat - Teaching application security 101]] <br>by [[OWASP_BeNeLux-Day_2017#WebGoat_-_Teaching_application_security_101_by_Nanne_Baars | Nanne Baars]]<br />
| rowspan="7" style="width:100px;" | [[OWASP_BeNeLux-Day_2017#Whiteboard_Hacking_aka_Hands-on_Threat Modeling_by_Sebastien Deleersnyder | Whiteboard Hacking aka Hands-on Threat Modeling]] <br>by [[OWASP_BeNeLux-Day_2017#Whiteboard_Hacking_aka_Hands-on_Threat Modeling_by_Sebastien Deleersnyder | Sebastien Deleersnyder]]<br />
| rowspan="7" style="width:100px;" | [[OWASP_BeNeLux-Day_2017#Secure_Development:_Models_and_best_practices_by_Bart_De_Win | Secure Development: Models and best practices]] <br>by [[OWASP_BeNeLux-Day_2017#Secure_Development:_Models_and_best_practices_by_Bart_De_Win | Bart De Win]]<br />
|-<br />
| 11h00 - 11h30 || ''Coffee Break''<br />
|-<br />
| 11h30 - 13h00 || Training<br />
|-<br />
| 13h00 - 14h00 || ''Lunch''<br />
|-<br />
| 14h00 - 15h30 || Training<br />
|-<br />
| 15h30 - 16h00 || ''Coffee Break''<br />
|-<br />
| 16h00 - 17h30 || Training<br />
|}<br />
<br />
== Trainings ==<br />
=== WebGoat - Teaching application security 101 by Nanne Baars ===<br />
====Topic(s) ====<br />
* Web Application Breaker<br />
* Other<br />
====Keywords ====<br />
WebGoat application, security teaching secure development<br />
<br />
====Abstract ====<br />
A good defense against insecure code requires understanding the mechanics behind how attackers exploit simple programming mistakes.<br />
The WebGoat team will walk through exercises like SQL Injection, XSS, XXE, CSRF, ... and demonstrate how these exploits work.<br />
<br />
We will show you how you can use WebGoat to train your developers to avoid these simple but common programming mistakes.<br />
<br />
We also show you how to extend WebGoat to create lessons specific to your environment.<br />
Join us to learn the most basic, but common, application security problems.<br />
<br />
Tired of all the lessons? During the training we will host a small CTF competition which you can take a shot at and compete with each other...<br />
<br />
=== Requirements===<br />
Please find the course prerequisites here: https://github.com/nbaars/owasp-training<br />
<br />
====Bio====<br />
Nanne Baars works as a security consultant & developer at JDriven and is one of the primary developers of WebGoat.<br />
<br />
=== Whiteboard Hacking aka Hands-on Threat Modeling by Sebastien Deleersnyder ===<br />
====Topic(s) ====<br />
* Threat modeling introduction<br />
* Diagrams – what are you building?<br />
* Identifying threats – what can go wrong?<br />
* Hands-on: STRIDE analysis of an Internet of Things (IoT) deployment with an on premise gateway and secure update service<br />
* Addressing each threats<br />
* Hands-on: threat mitigations OAuth scenarios for web and mobile applications<br />
<br />
====Keywords ====<br />
Threat Modeling, STRIDE, Technical risk assessment<br />
<br />
====Abstract ====<br />
This is a one day version of our Black Hat training on Threat Modeling. The students will be challenged to perform practical threat modeling in groups of 3 to 4 people covering the different stages of threat modeling on:<br />
* An Internet of Things (IoT) deployment with an on premise gateway and secure update service<br />
* An HR services OAuth scenario for mobile and web applications <br />
Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. It also allows consideration of security issues at the component or application level. The threat modeling course will teach you to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model. <br><br />
This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications, databases & Single sign on (SSO) principles.<br />
<br />
<br />
====Bio====<br />
Sebastien (lead application security consultant Toreon) led engagements in the domain of ICT-security, Web and Mobile Security with several customers in the private and public sector. Sebastien is the Belgian OWASP Chapter Leader and is co-project leader of OWASP SAMM.<br />
<br />
=== Secure Development: Models and best practices by Bart De Win ===<br />
====Topic(s) ====<br />
* Software Assurance maturity models<br />
* Secure Development in agile development<br />
* Tips and tricks for practical SDLC<br />
* Hands-on: SAMM analysis of your enterprise using SAMM 1.5<br />
* Sneak preview of SAMM 2.0<br />
<br />
====Keywords ====<br />
SDLC, SAMM, Agile development, <br />
<br />
====Abstract ====<br />
It takes much more than a good developer to build secure software within an organisation. Indeed, building secure software is about ensuring that security is taken into consideration during the entire software lifecycle. It is about ensuring that security best practices are being employed efficiently, and that uncovered risks are appropriately dealt with in due time.<br />
<br />
During this one-day training, we will introduce and discuss different secure development approaches and models. We will look into waterfall vs. agile development and discuss different strategies to successfully run an SDLC program. Finally, we will also put theorie into practice and take your organisation to perform a mini SDLC assessment and improvement exercise.<br />
[[File:Benelux2017 - Secure Development Training deck.pdf|thumb]]<br />
The slides of this session are available for download in the media file.<br />
<br />
====Bio====<br />
Bart is an application security consultant and enthousiast and is spending considerable time on secure development projects. Bart is board member of the Belgian OWASP Chapter and is co-project leader of OWASP SAMM.<br />
<br />
<br />
<!-- Fifth tab --><br />
<br />
= Conferenceday =<br />
=== Conferenceday is November 30th ===<br />
<br />
<br />
== Agenda (TBD)==<br />
{| class="wikitable"<br />
! width="120pt" | Time<br />
! width="190pt" | Speaker <br />
! width="400pt" | Topic<br />
! width="100pt" -- ! | Media<br />
|- <br />
| 08h30 - 09h00<br />
| colspan="3" style="text-align: center; background: grey; color: white" | ''Registration''<br />
|- <br />
| 09h00 - 09h15<br />
| colspan="3" style="text-align: center; background: grey; color: white" | ''Opening''<br />
|- <br />
| 09h15 - 10h00 || [[OWASP_BeNeLux-Day_2017#Attribute Based Access Control. Why, what, how? by Jacoba Sieders | Jacoba Sieders]]<br />
|| [[OWASP_BeNeLux-Day_2017#Attribute Based Access Control. Why, what, how? by Jacoba Sieders | Attribute Based Access Control. Why, what, how?]] <br />
|| [[Media:OWASP BeNeLux-Day 2017 AttributeBasedAccessControl WhyWhatHow JacobaSieders.pdf|Slides]]<br>[https://youtu.be/O7iWITnZGsk Video]<br />
|-<br />
| 10h00 - 10h45 || [[OWASP_BeNeLux-Day_2017#How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil by Matia Madou | Matias Madou]]<br />
|| [[OWASP_BeNeLux-Day_2017#How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil by Matia Madou | How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil]]<br />
|| [[Media:OWASP_BeNeLux-Day_2017_how_to_spend_$3.6_mil_on_one_coding_mistake_by_Matias_Madou.pdf|Slides]] <br> [https://www.youtube.com/watch?v=dt5rFGBztJA&feature=youtu.be Video]<br />
<br />
|-<br />
| 10h45 - 11h15 <br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Morning Break'' <br />
|-<br />
| 11h15 - 12h00 || [[OWASP_BeNeLux-Day_2017#The evil friend in your browser by Achim D. Brucker | Achim D. Brucker]]<br />
|| [[OWASP_BeNeLux-Day_2017#The evil friend in your browser by Achim D. Brucker | The evil friend in your browser]]<br />
| [[Media:OWASP_BeNeLux-Day_2017_The evil friend in your browser_Achim_Brucker.pdf|Slides]]<br>[https://www.youtube.com/watch?v=_Uj-Ci37Rvw&feature=youtu.be Video]<br />
|-<br />
| 12h00 - 12h45 || [[OWASP_BeNeLux-Day_2017#Exploring the ecosystem of malicious domain registrations in the .eu TLD by Lieven Desmet | Lieven Desmet]]<br />
|| [[OWASP_BeNeLux-Day_2017#Exploring the ecosystem of malicious domain registrations in the .eu TLD by Lieven Desmet | Exploring the ecosystem of malicious domain registrations in the .eu TLD]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Exploring the ecosystem of malicious domain registrations LievenDesmet.pdf|Slides]]<br>[https://www.youtube.com/watch?v=09SNSYHw8H0&feature=youtu.be Video]<br />
|-<br />
| 12h45 - 13h45<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Lunch'' <br />
|-<br />
| 13h45 - 14h30 || [[OWASP_BeNeLux-Day_2017#Don't trust the DOM: Bypassing XSS mitigations via script gadgets by Sebastian Lekies | Sebastian Lekies]]<br />
|| [[OWASP_BeNeLux-Day_2017#Don't trust the DOM: Bypassing XSS mitigations via script gadgets by Sebastian Lekies | Don't trust the DOM: Bypassing XSS mitigations via script gadgets]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Bypassing XSS mitigations via script gadgets Sebastian Lekies.pdf|Slides]]<br>[https://www.youtube.com/watch?v=rssg--FP1AE&feature=youtu.be Video]<br />
|-<br />
| 14h30 - 15h15 || [[OWASP_BeNeLux-Day_2017#A Series of Unfortunate Events: Where Malware Meets Murphy by Mattijs van Ommeren | Mattijs van Ommeren]]<br />
|| [[OWASP_BeNeLux-Day_2017#A Series of Unfortunate Events: Where Malware Meets Murphy by Mattijs van Ommeren | A Series of Unfortunate Events: Where Malware Meets Murphy]]<br />
| <!--[[Media:OWASP_Benelux-Day_2017_A_Series_Of_Unfortunate_Events-Where_Malware_Meets_Murphy_Mattijs_van_Ommeren.pdf|Slides]]<br> -->[https://www.youtube.com/watch?v=d67yxt3FdTA&feature=youtu.be Video]<br />
|-<br />
| 15h15 - 15h45<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Break'' <br />
|-<br />
| 15h45 - 16h30 || [[OWASP_BeNeLux-Day_2017#Common REST API security pitfalls by Philippe De Ryck | Philippe De Ryck]]<br />
|| [[OWASP_BeNeLux-Day_2017#Common REST API security pitfalls by Philippe De Ryck | Common REST API security pitfalls]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Common REST API security pitfalls Philippe De Ryck.pdf|Slides]]<br>[https://www.youtube.com/watch?v=Meh4EUmLCfM&feature=youtu.be Video]<br />
|-<br />
| 16h30 - 17h15 || [[OWASP_BeNeLux-Day_2017#Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded by Jeroen Willemsen | Jeroen Willemsen]]<br />
|| [[OWASP_BeNeLux-Day_2017#Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded by Jeroen Willemsen | Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded Jeroen Willemsen.pdf|Slides]]<br>[https://www.youtube.com/watch?v=Q3q1mdev5rs&feature=youtu.be Video]<br />
|-<br />
| 17h15 - 17h30<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Closing'' <br />
|}<br />
<br />
<div id="TBD"></div><br />
<br />
== Talks == <br />
<br />
===Attribute Based Access Control. Why, what, how? by Jacoba Sieders===<br />
====Abstract====<br />
Digitization is rapidly transforming the traditional world and regulation on security and data protection is gaining weight. Digital identity, but also data protection become crucial capabilities for businesses. What are the trends in IAM and what role can Attribute Based Access Control (ABAC) play here? ABNAMRO started implementing ABAC in 2014. What were the approach and the lessons learnt?<br />
====Bio====<br />
Jacoba Sieders, Head of Digital Identity- & Access, ABNAMRO Bank.<br /><br />
Jacoba is an all-round Digital Identity and Information Security expert with 17 years of experience in the international finance industry, in technology, governance, consultancy, and implementation. She is accountable for digital identity services and access control for customers, employees and partners to the bank’s data and infrastructure. <br />
Major topics on her agenda today are ABAC, data centric security, API-banking and PSDII requirements, the interaction of IAM tools with the rest of the bank’s cybersecurity landscape, and the new authentication concept for which ABNAMRO is acquiring a patent. Her special interests are legal requirements impacting identity, e.g. Generic Data Protection Regulation, the EU e-IDAS scheme, KYC and AML legislation. <br />
Jacoba is a member of the Advisory Board of the independent European think-tank ID Next and is regularly speaking on the topic of IAM. She holds a master degree in Classics from Leiden University (Greek, Latin, Hebrew). <br />
<br />
<br />
===How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil by Matia Madou===<br />
====Abstract====<br />
In a recent global study, the average cost of a data breach is $3.62M globally. This session will discuss infamous examples of data breaches that has made headlines around the world. We will explore the technical details of the vulnerability itself and what a coding solution may have been to prevent the breach. We will also dive deeper on exploring different solutions, processes and techniques you can apply in your day-to-day to prevent application security vulnerabilities in your code.<br />
====Bio====<br />
Matias Madou is a Co-Founder and CTO of Secure Code Warrior where he is responsible for leading the company’s technology vision and overseeing the engineering team. Matias has more than 15 years of hands-on software security experience and has developed solution for companies such as HP Fortify, and founded a company called Sensei Security. Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon. Matias holds a Ph.D. in Computer Engineering from Ghent University.<br />
<br />
<br />
===The evil friend in your browser by Achim D. Brucker===<br />
====Abstract====<br />
On the one hand, browser extensions, e.g., for Chrome, are very useful, as they extend web browsers with additional functionality<br />
(e.g., blocking ads). On the other hand, they are the most dangerous code that runs in your browsers: extension can read and modify both the content displayed in the browser. As they also can communicate with any web-site or web-service, they can report both data and metadata to external parties.<br />
<br />
The current security model for browser extensions seems to be inadequate for expressing the security or privacy needs of browser users. Consequently, browser extensions are a "juice target" for attackers targeting web users.<br />
<br />
We present results of analysing over 60000 browser extensions on how they use the current security model and discuss examples of extensions that are potentially of high risk. Based on the results of our analysis of real world browser extensions as well as our own threat model, we discuss the limitations of the current security model form a user perspective. need of browser users.<br />
<br />
====Bio====<br />
Dr. Achim D. Brucker (www.brucker.uk) is a Senior Lecturer and consultant for software and systems assurance at the Computer Science Department of The University of Sheffield, UK. Until December 2015, he was a Research Expert (Architect), Security Testing Strategist, and Project Lead in the Global Security Team of SAP SE, where he defined the risk-based security testing strategy of SAP that combines static, dynamic, and interactive security testing methods and integrates them deeply into SAP's Secure Software Development Lifecycle. He has experience in rolling out *AST tools to world-wide development organisations.<br />
<br />
===Exploring the ecosystem of malicious domain registrations in the .eu TLD by Lieven Desmet===<br />
====Abstract====<br />
In this talk, we report on an extensive analysis of 14 months of domain registration in the .eu TLD. The purpose is to identify large-scale malicious campaigns. Overall, the dataset of this study contains 824,121 new domain registrations; 2.53% of which have been flagged as malicious by blacklisting services. We explore the ecosystem and modus operandi of elaborate cybercriminal entities that recurrently register large amounts of domains for one-shot, malicious use. Although these malicious domains are short-lived, we establish that at least 80.04% of them can be framed in to 20 larger campaigns with varying duration and intensity. We further report on insights in the operational aspects of this business and observe, amongst other findings, that their processes are only partially automated. <br />
====Bio====<br />
Lieven Desmet is a Senior Research Manager on Secure Software in the imec-DistriNet Research Group at the Katholieke Universiteit Leuven (Belgium), where he outlines and implements the research strategy, coaches junior researchers in application security, and participates in dissemination, valorisation and spin-off activities. Lieven is also involved in OWASP as a board member of the Belgium OWASP Chapter, and part of the organisation team of the OWASP BeNeLux Day.<br />
<br />
===Don't trust the DOM: Bypassing XSS mitigations via script gadgets by Sebastian Lekies===<br />
====Abstract====<br />
Cross-Site Scripting is a constant problem of the Web platform. Over the years many techniques have been introduced to prevent or mitigate XSS. Most of these techniques, thereby, focus on script tags and event handlers. HTML sanitizers, for example, aim at removing potentially dangerous tags and attributes. Another example is the Content Security Policy, which forbids inline event handlers and aims at white listing of legitimate scripts.<br />
<br />
In this talk, we present a novel Web hacking technique that enables an attacker to circumvent most XSS mitigations. In order to do so, the attacker abuses so-called script gadgets. A script gadget Is a legitimate piece of JavaScript in a page that reads elements from the DOM via selectors and processes them in a way that results in script execution. To abuse a script gadget, the attacker injects a benign looking element into the page that matches the gadget's selector. Subsequently, the gadget selects the benign-looking element and executes attacker-controlled scripts. As the initially injected element is benign it passes HTML sanitizers and security policies. The XSS only surfaces when the gadget mistakenly elevates the privileges of the element.<br />
<br />
In this talk, we will demonstrate that these gadgets are present in almost all modern JavaScript libraries, APIs and applications. We will present several case studies and real-world examples that demonstrate that many mitigation techniques are not suited for modern applications. As a result, we argue that the Web should start focusing more on preventive mechanisms instead of mitigations.<br />
====Bio====<br />
Sebastian Lekies is tech leading the Web application security scanning team at Google. Before joining Google, he was part of SAP's Security Research team, where he conducted academic research in the area of client-side Web application security. Sebastian is regularly speaking at academic and non-academic security conferences such as BlackHat US/EU/Asia, DeepSec, OWASP AppSec EU, Usenix Security, CCS, and many more...<br />
<br />
<br />
===A Series of Unfortunate Events: Where Malware Meets Murphy by Mattijs van Ommeren===<br />
====Abstract====<br />
When an end user reports some “strange looking file names”, which, after investigating, you discover include several hundreds of Gigabytes of encrypted data, you of course know you are going to have a bad day. Your AV solution has failed you, your firewall has failed you, and your SIEM has failed you. Basically, every piece of security infrastructure you have put your trust (and money) into has left you out in the cold and you thank <deity of choice> that at least the nightly backup was completed successfully. Spin up the tape drive, and soon you will be back in business, or not…?<br />
<br />
This talk is about failure. Not only about a failing security infrastructure, but also about failure in doing the Right Thing™ as a first responder, about the failure of Operating System tools, failing APIs, and ironically, also the failure of malware (which is unfortunately not as positive as it may sound). The scenario presented comes pretty close to the worst chain of events you can imagine, in an attempt to recover from a ransomware incident.<br />
<br />
Luckily – this story has a happy ending. We will reveal how one can be prepared for when both Count Olaf and Murphy come knocking on your door simultaneously.<br />
====Bio====<br />
Mattijs van Ommeren has been poking hardware and software for 15 years. He has spent most of his working life as a security consultant, attacking and defending both traditional IT environments as well as more esoteric embedded devices and industrial systems. Presently he has a lot of fun at Nixu.<br />
<br />
<br />
===Common REST API security pitfalls by Philippe De Ryck===<br />
====Abstract====<br />
The shift towards a REST API landscape indicates a significant evolution in the way we build applications. The rise of JavaScript and mobile applications have sparked an explosion of easily-accessible REST APIs. But how do you protect access to your API? Which security aspects are no longer relevant? Which security features are an absolutely must-have, and which additional security measures do you need to take into account?<br />
<br />
These are hard questions, as evidenced by the deployment of numerous insecure REST APIs. Attend this session to find out about common API security pitfalls, that often result in compromised user accounts and unauthorized access to your data. We expose the problem that lies at the root of each of these pitfalls, and offer actionable advice to address these security problems. After this session, you will know how to assess the security of your APIs, and the best practices to improve them towards the future.<br />
====Bio====<br />
Philippe De Ryck is a professional speaker and trainer on software security and web security. Since he obtained his PhD at the imec-DistriNet research group (KU Leuven, Belgium), he has been running the group's Web Security Training program, which ensures a sustainable knowledge transfer of the group’s security expertise towards practitioners.<br />
<br />
<br />
===Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded by Jeroen Willemsen===<br />
====Abstract====<br />
Join us on our adventure of setting up a appsec pipeline with Docker containers. What did go wrong, how did we succeed? How do you fight false positives and how do you get the best out of the products out there without bothering the development teams too much.<br />
====Bio====<br />
Jeroen Willemsen is a security architect with a passion for mobile and risk management. He loves to work on secure building blocks, security automation pipelines and embedding information security risk management controls in an agile environment. He is dedicated to help developers, product owners and architects to take security seriously in their daily development life (but not too serious of course ;-)).In his spare time he loves to experiment with new technologies and frameworks.”<br />
<br />
<br />
<!-- Sixth tab --><br />
<br />
= Social Event (TBD)=<br />
<br />
== Social Event,starting at 7PM ==<br />
Thursday, November 23rd<br />
;Dudok Tilburg<br />
:Veemarktstraat 33<br />
:5038 CT Tilburg<br />
:http://www.dudok.nl/<br />
Menu:<br />
:As we are a big group, Dudok will prepare the following [[Media:Dudok menu OWASP.pdf|menu]] for us!<br />
'''If you want to join the social event, don't forget to register for the social event via the registration:'''<br />
:[[image:Register_now_red.png|link=https://owasp-benelux-day-2017.eventbrite.com |200px|alt=Register for the OWASP BeNeLux Day 2017 | Register for the OWASP BeNeLux Day 2017 ]]<br />
<br />
<br />
(limited) open tap sponsored by :<br />
[[File:Avi Logo Transparent Background 300pix.png|200px|link=https://avinetworks.com/]] <br />
<br />
<!-- Seventh tab --><br />
<br />
= Sponsor =<br />
<br />
=== Become a sponsor of OWASP BeNeLux ===<br />
<br />
There are 3 combined sponsorship packages (Gold, Silver or Bronze) that cover the BeNeLux chapter meetings 2019 and the BeNeLux OWASP Days 2018.<br />
<br />
Download our [https://www.owasp.org/images/a/a9/OWASP_BeNeLux_2018_Sponsorship_Form_v20180919.pdf sponsor brochure] and contact [mailto:seba@owasp.org us] for questions or sponsorship confirmation!<br />
<br />
Your sponsorship will be invested directly in the chapter meetings, supporting speaker and catering expenses. <br />
<br />
The sponsorship will also be dedicated to cover the costs of the OWASP 2018 BeNeLux event.<br />
<br />
<!-- Don't remove these two lines! -->__NOTOC__ <br />
<headertabs></headertabs><br />
<br />
=== Made possible by our {{#switchtablink:Sponsor|Sponsors}}===<br />
'''Hosted by'''<br />
<br />
<br />
'''Platinum:'''<br />
<br />
<br />
'''Gold:'''<br />
<br />
<br />
'''Silver:'''<br />
<br />
<br />
'''Bronze:'''<br />
<br />
<br />
[[Category:OWASP_AppSec_Conference]] <br />
[[Category:OWASP_BeNeLux_Archives]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:OWASP_BeNeLux_2018_Sponsorship_Form_v20180919.pdf&diff=243524File:OWASP BeNeLux 2018 Sponsorship Form v20180919.pdf2018-09-19T12:57:31Z<p>Sdeleersnyder: </p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=Belgium_Events_2018&diff=243519Belgium Events 20182018-09-19T08:33:30Z<p>Sdeleersnyder: </p>
<hr />
<div><noinclude><br />
These are the 2018 events of the [[Belgium|OWASP Belgium Chapter]].<br />
<br />
Previous year: [[Belgium Events 2017|2017]].<br />
</noinclude><br />
== 17 September 2018 Meeting ==<br />
<br />
=== WHEN ===<br />
Monday 17 September 2018<br />
<br />
=== WHERE ===<br />
<br />
; Host: European Commission<br />
: Place Madou, 1<br />
:1210 - Saint-Josse-Ten-Noode<br />
<pre style="color: red"><br />
Pre-registration of the participants' ID is needed to enter the venue; see registration link below!!!<br><br />
PARKING WILL NOT BE AVAILABLE<br />
</pre><br />
<br />
=== PROGRAM ===<br />
The agenda:<br />
<br />
*18h00 - 18h50: '''Welcome & sandwiches''' <br> <br />
*18h50 - 19h00: '''[https://www.owasp.org/images/9/9b/Owasp_Belgium_update_2018-09-17_v1.pptx OWASP Update]''' (by Sebastien Deleersnyder, OWASP) <br> <br />
*19h00 - 19h10: '''Intro by the EC''' (by Miguel Soria Machado, Head of Sector (CSIRC), DIGIT IT Security Directorate, European Commission) <br> <br />
*19h10 - 20h00: '''[https://www.owasp.org/images/1/17/Dirk_Wetter_-_Docker_Security_Brussels.pdf Docker Threat Modeling and Top 10]''' (by Dirk Wetter)<br><br />
:''Abstract:'' Docker containers offer several advantages for developers. Most notably they fit perfectly in software development processes, they enable fast, reproducible<br />
deployments and when properly done, with little change the same container can<br />
run either in a test or production environment.<br />
<br />
Despite threatening information out there Docker offers per se also several<br />
security advantages. However it is important to make use of them and as a<br />
minimum avoid several pitfalls. In a worst case scenario this can lead<br />
otherwise to less security or the security benefits which the containment<br />
technology offers are not being used at all.<br />
<br />
To avoid this a proper fundamental approach is needed.<br />
<br />
Thus this talk models first the most important threats to containerized<br />
environments out there. Based on that the speaker will present 10 security<br />
bullet points which covers<br />
<br />
* important Do's and Dont's,<br />
* for advanced needs how to tighten security further.<br />
<br />
At the end the speaker gives advice how to check your Docker and<br />
Kubernetes security status yourself.<br />
<br />
The talk is based on practical experiences at several costumers and on the<br />
speaker's solid network and systems security expertise.<br />
<br />
:''Bio:'' [https://twitter.com/drwetter Dirk Wetter (Ph.D.)] is an independent security consultant with more than 20 years professional experience in information security with a broad technical<br />
and information security management background.<br />
<br />
His primary focus nowadays is around web application security. He has also a<br />
solid background on network and systems security.<br />
<br />
He's also founder and maintainer of the open source project testssl.sh which<br />
checks the encryption of every SSL/TLS enabled service.<br />
<br />
*20h00 - 20h10: break <br> <br />
*20h10 - 21h00: '''Securing Containers on the High Seas''' (by Jack Mannino)<br><br />
:''Abstract:'' It can be a difficult challenge for organizations to securely migrate to containers while shifting processes and security controls. Making the move from legacy virtualization and monolithic deployments to containers requires a solid strategy. Containers offer many inherent security benefits but it’s important to build controls in beyond the containers themselves. From development through container registries and deployment to a runtime environment, it’s important to enforce security and eliminate risks as they’re introduced.<br />
<br />
This presentation will focus on scaling container security within an enterprise and building security controls into the way you build, ship, and run containerized services. We will discuss the modern container landscape including different container runtimes and isolation models. We will explore the container lifecycle from your developer’s laptop through your production environment and examine the key security problems to mitigate.<br />
<br />
:''Bio:'' [https://twitter.com/jack_mannino Jack Mannino] is the CEO of nVisium. Passionate about security and impossible to keep away from a keyboard, his expertise spans over 15 years of building, breaking, and securing software. Jack founded nVisium in 2009, and since has helped the world's largest software teams enhance security across their software portfolios. He has spoken at conferences globally on topics such as secure design, mobile application security, and cloud-native security.<br />
<br />
=== REGISTRATION ===<br />
<pre style="color: red"><br />
Two step registration:<br />
Step 1: Registration via Eventbrite<br />
Step 2: Pre-registration of participants'ID (European Commission)<br />
<br />
Pre-registration of the participants' ID will be needed to enter the security on site!!!<br />
</pre><br />
<br />
'''Step 1''': Registration via Eventbrite: https://owasp-belgium-2018-09-17.eventbrite.com<br />
<br />
'''Step 2''': Pre-registration of participants'ID: https://ec.europa.eu/eusurvey/runner/OWASPBelgiumChapterMeetingSept17 .<br />
<br />
'''The registration deadline for the participants' ID expires on ''Sunday, September 16th midnight''. After this time the registration and admission to the event will not be possible.'''<br />
<br />
=== Coverage ===<br />
<br />
<br />
== 19 March 2018 Meeting ==<br />
<br />
=== Where ===<br />
<br />
* Host: [https://www.ing.be ING Belgium]<br />
<br />
* Address ([https://branches.ing.be/branch/1040_bxl-non-residents map])<br />
Cours St Michel 60<br />
1040 Brussel<br />
<br />
=== Agenda ===<br />
<br />
* 18h15 - 19h00: Welcome & sandwiches<br />
* 19h00 - 19h10: OWASP Update (by Sebastien Deleersnyder, OWASP)<br />
* 19h10 - 20h00: [[#2018-03-19 Talk 1|KRACKing WPA2 in Practice Using Key Reinstallation Attacks]] (by Mathy Vanhoef, imec-DistriNet-KU Leuven)<br />
* 20h00 - 20h10: Break<br />
* 20h10 - 21h00: [[#2018-03-19 Talk 2|Making the web secure by design]] (by Glenn Ten Cate, ING Belgium, and Riccardo Ten Cate, Xebia)<br />
* 21h00 - 21h30: Networking drink<br />
<br />
=== Program ===<br />
<br />
==== <span id="2018-03-19 Talk 1">KRACKing WPA2 in Practice Using Key Reinstallation Attacks</span> ====<br />
<br />
* Speaker: Mathy Vanhoef, imec-DistriNet-KU Leuven)<br />
<br />
''Abstract''<br />
<br />
This talk presents the key reinstallation attack against WPA2 (KRACK attack). It abuses design or implementation flaws in cryptographic protocols to reinstall an already-in-use key. This resets the key’s associated parameters such as transmit nonces and receive replay counters. Several cryptographic Wi-Fi handshakes are affected by the attack.<br />
<br />
All protected Wi-Fi networks use the 4-way handshake to generate a fresh session key. So far, this 14-year-old handshake has remained free from attacks. However, we show that the 4-way handshake is vulnerable to a key reinstallation attack. Here, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying handshake messages. When reinstalling the key, associated parameters such as the incremental transmit packet number (nonce) and receive packet number (replay counter) are reset to their initial value.<br />
<br />
The talk also discusses the vulnerability disclosure process that was followed. Since the discovery affected numerous vendors, coordinating the disclosure was non-trivial.<br />
<br />
''Speaker Bio''<br />
<br />
Mathy Vanhoef is a postdoctoral researcher at KU Leuven. He did his PhD on the security of WPA-TKIP, TLS, and RC4. His research interest is in computer security with a focus on wireless security (e.g. Wi-Fi), network protocols in general, the RC4 stream cipher (where he discovered the RC NOMORE attack), and software security (discovering and exploiting vulnerabilities). Currently his main research is about automatically discovering vulnerabilities in network protocol implementations, and proving the correctness of protocol implementations.<br />
<br />
==== <span id="2018-03-19 Talk 2">Making the web secure by design</span> ====<br />
<br />
* Speaker: Glenn Ten Cate, ING Belgium, and Riccardo Ten Cate, Xebia<br />
<br />
''Abstract''<br />
<br />
Education is the first step in the Secure Software Development Lifecycle. The free OWASP Security Knowledge Framework (SKF) is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. This talk will help you as a developer to become THE Neo of your development team. We will show how you can do security by design and introduce other quality gates into your development pipeline to ensure high end quality and security of your project.<br />
<br />
''Speaker Bios''<br />
<br />
As a coder, hacker, speaker, trainer and security researcher employed at ING Belgium, '''Glenn Ten Cate''' has over 10 years experience in the field of security. One of the founders of defensive development [defdev] a security training and conference series dedicated to helping you build and maintain secure software and also speaking at multiple other security conferences in the world. His goals is to create an open-source software development life cycle with the tools and knowledge gathered over the years.<br />
<br />
As a penetration tester from the Netherlands employed at Xebia, '''Riccardo Ten Cate''' specialises in web-application security and has extensive knowledge in securing web applications in multiple coding languages. He is also a specialist in setting up Secure Software Development Life Cycles.<br />
<br />
=== Registration ===<br />
<br />
Registration was via EventBrite: https://owasp-belgium-2018-03-19.eventbrite.com<br />
<br />
=== Coverage ===<br />
<br />
<br />
== 20 February 2018 Meeting ==<br />
<br />
=== Where ===<br />
<br />
* Host: [https://distrinet.cs.kuleuven.be DistriNet Research Group (KU Leuven)] (Both speakers are faculty of the [https://www.secappdev.org/ Secure Application Development] course held in Leuven from 2018-02-19 to 2018-02-23.)<br />
<br />
* Address ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap map], [https://distrinet.cs.kuleuven.be/about/route/ directions]):<br />
Department of Computer Science (foyer at ground floor)<br />
Celestijnenlaan 200 A<br />
3001 Heverlee<br />
<br />
=== Agenda ===<br />
<br />
*18h15 - 19h00: Welcome & sandwiches<br />
*19h00 - 19h10: [https://www.owasp.org/images/7/7a/Owasp_Belgium_update_2018-02-20_v1.pdf OWASP Update] (by Sebastien Deleersnyder, OWASP)<br />
*19h10 - 20h00: [[#2018-02-20 Talk 1|Developers are not the enemy -- Usable Security for Experts]] (by Prof. Matthew Smith, University of Bonn)<br />
*20h00 - 20h10: Break<br />
*20h10 - 21h00: [[#2018-02-20 Talk 2|The Code Behind The Vulnerability]] (by Barry Dorrans, Microsoft)<br />
<br />
=== Program ===<br />
<br />
==== <span id="2018-02-20 Talk 1">Developers are not the enemy -- Usable Security for Experts</span> ====<br />
<br />
* Speaker: Prof. Matthew Smith, University of Bonn<br />
* Presentation: https://schd.ws/hosted_files/secappdev2018/a9/Developer%20are%20not%20the%20enemy%20SecAppDev%20web.pdf<br />
<br />
''Abstract''<br />
<br />
Usability problems are a major cause of many of today's IT-security incidents. Security systems are often too complicated, time-consuming, and error prone. For more than a decade researchers in the domain of usable security (USEC) have attempted to combat these problems by conducting interdisciplinary research focusing on the root causes of the problems and on the creation of usable security mechanisms. While major improvements have been made, to date USEC research has focused almost entirely on the non-expert end-user. However, many of the most catastrophic security incidents were not caused by end-users, but by developers or administrators. Heartbleed and Shellshock were both caused by single developers yet had global consequences. The Sony hack in 2014 compromised an entire multi-national IT-infrastructure and misappropriated over 100 TB of data, unnoticed. Fundamentally, every software vulnerability and misconfigured system is caused by developers or administrators making mistakes, but very little research has been done into the underlying causalities and possible mitigation strategies. In this talk we will explore the transition from end-user to expert usable security research and look at several application areas, including TLS, passwords, malware analysis and vulnerability analysis.<br />
<br />
''Speaker Bio''<br />
<br />
Matthew Smith is a Professor for Usable Security and Privacy at the University of Bonn. His research is focused on human factors of security and privacy mechanisms with a wide range of application areas, including TLS and network security, authentication, mobile and app security and, most recently, usable security for developers and administrators. His work has been published at, among others, IEEE S&P, ACM CCS, USENIX Security, NDSS, ACM SIGCHI and SOUPS the Symposium on Usable Security and Privacy. In 2015 his ERC Starting Grant "Frontiers of Usable Security" was selected for funding.<br />
<br />
==== <span id="2018-02-20 Talk 2">The Code Behind The Vulnerability</span> ====<br />
<br />
* Speaker: Barry Dorrans, Microsoft<br />
* Presentation: https://schd.ws/hosted_files/secappdev2018/75/The%20code%20behind%20the%20vulnerability.pdf<br />
<br />
''Abstract''<br />
<br />
Everyone makes security mistakes, and that includes Microsoft (seriously!). Many developers can spot and prevent vulnerabilities listed in the OWASP top 10. But that narrative changes when we look beyond the scope of the OWASP top 10. Compared to some more recent attacks, fixing XSS or SQL injection almost seems easy. In this session, we dive into a couple of .NET core cases that have been reported to the Microsoft Security Response Center (MSRC). Mind you; these vulnerabilities are not just framework vulnerabilities. Instead, they are coding patterns that you may have introduced in your applications. Examples are issues with hash tables, compression, encryption, regular expressions and more. In this session, you will learn how to spot these vulnerabilities in your code. On top of that, you will walk away with the skills to fix them.<br />
<br />
''Speaker Bio''<br />
<br />
Barry Dorrans is the .NET Security Czar, which means he tries to tell everyone else how to code securely and taking the credit when it goes right, as well as running the .NET Core Bug Bounty. He also ends up triaging publicly and privately reported vulnerabilities when it goes wrong before getting someone else to fix the mistakes. This he gets all the fun and none of the real work, aside from the endless stress wondering when the next vulnerability will be discovered.<br />
<br />
=== Registration ===<br />
<br />
Registration was via EventBrite: https://owasp-belgium-2018-02-20.eventbrite.com<br />
<br />
=== Coverage ===<br />
<br />
n/a</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:Owasp_Belgium_update_2018-09-17_v1.pptx&diff=243518File:Owasp Belgium update 2018-09-17 v1.pptx2018-09-19T08:33:07Z<p>Sdeleersnyder: </p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:Dirk_Wetter_-_Docker_Security_Brussels.pdf&diff=243517File:Dirk Wetter - Docker Security Brussels.pdf2018-09-19T08:32:04Z<p>Sdeleersnyder: </p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=Belgium_Events_2018&diff=243481Belgium Events 20182018-09-17T07:19:28Z<p>Sdeleersnyder: </p>
<hr />
<div><noinclude><br />
These are the 2018 events of the [[Belgium|OWASP Belgium Chapter]].<br />
<br />
Previous year: [[Belgium Events 2017|2017]].<br />
</noinclude><br />
== 17 September 2018 Meeting ==<br />
<br />
=== WHEN ===<br />
Monday 17 September 2018<br />
<br />
=== WHERE ===<br />
<br />
; Host: European Commission<br />
: Place Madou, 1<br />
:1210 - Saint-Josse-Ten-Noode<br />
<pre style="color: red"><br />
Pre-registration of the participants' ID is needed to enter the venue; see registration link below!!!<br><br />
PARKING WILL NOT BE AVAILABLE<br />
</pre><br />
<br />
=== PROGRAM ===<br />
The agenda:<br />
<br />
*18h00 - 18h50: '''Welcome & sandwiches''' <br> <br />
*18h50 - 19h00: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP) <br> <br />
*19h00 - 19h10: '''Intro by the EC''' (by Miguel Soria Machado, Head of Sector (CSIRC), DIGIT IT Security Directorate, European Commission) <br> <br />
*19h10 - 20h00: '''Docker Threat Modeling and Top 10''' (by Dirk Wetter)<br><br />
:''Abstract:'' Docker containers offer several advantages for developers. Most notably they fit perfectly in software development processes, they enable fast, reproducible<br />
deployments and when properly done, with little change the same container can<br />
run either in a test or production environment.<br />
<br />
Despite threatening information out there Docker offers per se also several<br />
security advantages. However it is important to make use of them and as a<br />
minimum avoid several pitfalls. In a worst case scenario this can lead<br />
otherwise to less security or the security benefits which the containment<br />
technology offers are not being used at all.<br />
<br />
To avoid this a proper fundamental approach is needed.<br />
<br />
Thus this talk models first the most important threats to containerized<br />
environments out there. Based on that the speaker will present 10 security<br />
bullet points which covers<br />
<br />
* important Do's and Dont's,<br />
* for advanced needs how to tighten security further.<br />
<br />
At the end the speaker gives advice how to check your Docker and<br />
Kubernetes security status yourself.<br />
<br />
The talk is based on practical experiences at several costumers and on the<br />
speaker's solid network and systems security expertise.<br />
<br />
:''Bio:'' [https://twitter.com/drwetter Dirk Wetter (Ph.D.)] is an independent security consultant with more than 20 years professional experience in information security with a broad technical<br />
and information security management background.<br />
<br />
His primary focus nowadays is around web application security. He has also a<br />
solid background on network and systems security.<br />
<br />
He's also founder and maintainer of the open source project testssl.sh which<br />
checks the encryption of every SSL/TLS enabled service.<br />
<br />
*20h00 - 20h10: break <br> <br />
*20h10 - 21h00: '''Securing Containers on the High Seas''' (by Jack Mannino)<br><br />
:''Abstract:'' It can be a difficult challenge for organizations to securely migrate to containers while shifting processes and security controls. Making the move from legacy virtualization and monolithic deployments to containers requires a solid strategy. Containers offer many inherent security benefits but it’s important to build controls in beyond the containers themselves. From development through container registries and deployment to a runtime environment, it’s important to enforce security and eliminate risks as they’re introduced.<br />
<br />
This presentation will focus on scaling container security within an enterprise and building security controls into the way you build, ship, and run containerized services. We will discuss the modern container landscape including different container runtimes and isolation models. We will explore the container lifecycle from your developer’s laptop through your production environment and examine the key security problems to mitigate.<br />
<br />
:''Bio:'' [https://twitter.com/jack_mannino Jack Mannino] is the CEO of nVisium. Passionate about security and impossible to keep away from a keyboard, his expertise spans over 15 years of building, breaking, and securing software. Jack founded nVisium in 2009, and since has helped the world's largest software teams enhance security across their software portfolios. He has spoken at conferences globally on topics such as secure design, mobile application security, and cloud-native security.<br />
<br />
=== REGISTRATION ===<br />
<pre style="color: red"><br />
Two step registration:<br />
Step 1: Registration via Eventbrite<br />
Step 2: Pre-registration of participants'ID (European Commission)<br />
<br />
Pre-registration of the participants' ID will be needed to enter the security on site!!!<br />
</pre><br />
<br />
'''Step 1''': Registration via Eventbrite: https://owasp-belgium-2018-09-17.eventbrite.com<br />
<br />
'''Step 2''': Pre-registration of participants'ID: https://ec.europa.eu/eusurvey/runner/OWASPBelgiumChapterMeetingSept17 .<br />
<br />
'''The registration deadline for the participants' ID expires on ''Sunday, September 16th midnight''. After this time the registration and admission to the event will not be possible.'''<br />
<br />
=== Coverage ===<br />
<br />
<br />
== 19 March 2018 Meeting ==<br />
<br />
=== Where ===<br />
<br />
* Host: [https://www.ing.be ING Belgium]<br />
<br />
* Address ([https://branches.ing.be/branch/1040_bxl-non-residents map])<br />
Cours St Michel 60<br />
1040 Brussel<br />
<br />
=== Agenda ===<br />
<br />
* 18h15 - 19h00: Welcome & sandwiches<br />
* 19h00 - 19h10: OWASP Update (by Sebastien Deleersnyder, OWASP)<br />
* 19h10 - 20h00: [[#2018-03-19 Talk 1|KRACKing WPA2 in Practice Using Key Reinstallation Attacks]] (by Mathy Vanhoef, imec-DistriNet-KU Leuven)<br />
* 20h00 - 20h10: Break<br />
* 20h10 - 21h00: [[#2018-03-19 Talk 2|Making the web secure by design]] (by Glenn Ten Cate, ING Belgium, and Riccardo Ten Cate, Xebia)<br />
* 21h00 - 21h30: Networking drink<br />
<br />
=== Program ===<br />
<br />
==== <span id="2018-03-19 Talk 1">KRACKing WPA2 in Practice Using Key Reinstallation Attacks</span> ====<br />
<br />
* Speaker: Mathy Vanhoef, imec-DistriNet-KU Leuven)<br />
<br />
''Abstract''<br />
<br />
This talk presents the key reinstallation attack against WPA2 (KRACK attack). It abuses design or implementation flaws in cryptographic protocols to reinstall an already-in-use key. This resets the key’s associated parameters such as transmit nonces and receive replay counters. Several cryptographic Wi-Fi handshakes are affected by the attack.<br />
<br />
All protected Wi-Fi networks use the 4-way handshake to generate a fresh session key. So far, this 14-year-old handshake has remained free from attacks. However, we show that the 4-way handshake is vulnerable to a key reinstallation attack. Here, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying handshake messages. When reinstalling the key, associated parameters such as the incremental transmit packet number (nonce) and receive packet number (replay counter) are reset to their initial value.<br />
<br />
The talk also discusses the vulnerability disclosure process that was followed. Since the discovery affected numerous vendors, coordinating the disclosure was non-trivial.<br />
<br />
''Speaker Bio''<br />
<br />
Mathy Vanhoef is a postdoctoral researcher at KU Leuven. He did his PhD on the security of WPA-TKIP, TLS, and RC4. His research interest is in computer security with a focus on wireless security (e.g. Wi-Fi), network protocols in general, the RC4 stream cipher (where he discovered the RC NOMORE attack), and software security (discovering and exploiting vulnerabilities). Currently his main research is about automatically discovering vulnerabilities in network protocol implementations, and proving the correctness of protocol implementations.<br />
<br />
==== <span id="2018-03-19 Talk 2">Making the web secure by design</span> ====<br />
<br />
* Speaker: Glenn Ten Cate, ING Belgium, and Riccardo Ten Cate, Xebia<br />
<br />
''Abstract''<br />
<br />
Education is the first step in the Secure Software Development Lifecycle. The free OWASP Security Knowledge Framework (SKF) is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. This talk will help you as a developer to become THE Neo of your development team. We will show how you can do security by design and introduce other quality gates into your development pipeline to ensure high end quality and security of your project.<br />
<br />
''Speaker Bios''<br />
<br />
As a coder, hacker, speaker, trainer and security researcher employed at ING Belgium, '''Glenn Ten Cate''' has over 10 years experience in the field of security. One of the founders of defensive development [defdev] a security training and conference series dedicated to helping you build and maintain secure software and also speaking at multiple other security conferences in the world. His goals is to create an open-source software development life cycle with the tools and knowledge gathered over the years.<br />
<br />
As a penetration tester from the Netherlands employed at Xebia, '''Riccardo Ten Cate''' specialises in web-application security and has extensive knowledge in securing web applications in multiple coding languages. He is also a specialist in setting up Secure Software Development Life Cycles.<br />
<br />
=== Registration ===<br />
<br />
Registration was via EventBrite: https://owasp-belgium-2018-03-19.eventbrite.com<br />
<br />
=== Coverage ===<br />
<br />
<br />
== 20 February 2018 Meeting ==<br />
<br />
=== Where ===<br />
<br />
* Host: [https://distrinet.cs.kuleuven.be DistriNet Research Group (KU Leuven)] (Both speakers are faculty of the [https://www.secappdev.org/ Secure Application Development] course held in Leuven from 2018-02-19 to 2018-02-23.)<br />
<br />
* Address ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap map], [https://distrinet.cs.kuleuven.be/about/route/ directions]):<br />
Department of Computer Science (foyer at ground floor)<br />
Celestijnenlaan 200 A<br />
3001 Heverlee<br />
<br />
=== Agenda ===<br />
<br />
*18h15 - 19h00: Welcome & sandwiches<br />
*19h00 - 19h10: [https://www.owasp.org/images/7/7a/Owasp_Belgium_update_2018-02-20_v1.pdf OWASP Update] (by Sebastien Deleersnyder, OWASP)<br />
*19h10 - 20h00: [[#2018-02-20 Talk 1|Developers are not the enemy -- Usable Security for Experts]] (by Prof. Matthew Smith, University of Bonn)<br />
*20h00 - 20h10: Break<br />
*20h10 - 21h00: [[#2018-02-20 Talk 2|The Code Behind The Vulnerability]] (by Barry Dorrans, Microsoft)<br />
<br />
=== Program ===<br />
<br />
==== <span id="2018-02-20 Talk 1">Developers are not the enemy -- Usable Security for Experts</span> ====<br />
<br />
* Speaker: Prof. Matthew Smith, University of Bonn<br />
* Presentation: https://schd.ws/hosted_files/secappdev2018/a9/Developer%20are%20not%20the%20enemy%20SecAppDev%20web.pdf<br />
<br />
''Abstract''<br />
<br />
Usability problems are a major cause of many of today's IT-security incidents. Security systems are often too complicated, time-consuming, and error prone. For more than a decade researchers in the domain of usable security (USEC) have attempted to combat these problems by conducting interdisciplinary research focusing on the root causes of the problems and on the creation of usable security mechanisms. While major improvements have been made, to date USEC research has focused almost entirely on the non-expert end-user. However, many of the most catastrophic security incidents were not caused by end-users, but by developers or administrators. Heartbleed and Shellshock were both caused by single developers yet had global consequences. The Sony hack in 2014 compromised an entire multi-national IT-infrastructure and misappropriated over 100 TB of data, unnoticed. Fundamentally, every software vulnerability and misconfigured system is caused by developers or administrators making mistakes, but very little research has been done into the underlying causalities and possible mitigation strategies. In this talk we will explore the transition from end-user to expert usable security research and look at several application areas, including TLS, passwords, malware analysis and vulnerability analysis.<br />
<br />
''Speaker Bio''<br />
<br />
Matthew Smith is a Professor for Usable Security and Privacy at the University of Bonn. His research is focused on human factors of security and privacy mechanisms with a wide range of application areas, including TLS and network security, authentication, mobile and app security and, most recently, usable security for developers and administrators. His work has been published at, among others, IEEE S&P, ACM CCS, USENIX Security, NDSS, ACM SIGCHI and SOUPS the Symposium on Usable Security and Privacy. In 2015 his ERC Starting Grant "Frontiers of Usable Security" was selected for funding.<br />
<br />
==== <span id="2018-02-20 Talk 2">The Code Behind The Vulnerability</span> ====<br />
<br />
* Speaker: Barry Dorrans, Microsoft<br />
* Presentation: https://schd.ws/hosted_files/secappdev2018/75/The%20code%20behind%20the%20vulnerability.pdf<br />
<br />
''Abstract''<br />
<br />
Everyone makes security mistakes, and that includes Microsoft (seriously!). Many developers can spot and prevent vulnerabilities listed in the OWASP top 10. But that narrative changes when we look beyond the scope of the OWASP top 10. Compared to some more recent attacks, fixing XSS or SQL injection almost seems easy. In this session, we dive into a couple of .NET core cases that have been reported to the Microsoft Security Response Center (MSRC). Mind you; these vulnerabilities are not just framework vulnerabilities. Instead, they are coding patterns that you may have introduced in your applications. Examples are issues with hash tables, compression, encryption, regular expressions and more. In this session, you will learn how to spot these vulnerabilities in your code. On top of that, you will walk away with the skills to fix them.<br />
<br />
''Speaker Bio''<br />
<br />
Barry Dorrans is the .NET Security Czar, which means he tries to tell everyone else how to code securely and taking the credit when it goes right, as well as running the .NET Core Bug Bounty. He also ends up triaging publicly and privately reported vulnerabilities when it goes wrong before getting someone else to fix the mistakes. This he gets all the fun and none of the real work, aside from the endless stress wondering when the next vulnerability will be discovered.<br />
<br />
=== Registration ===<br />
<br />
Registration was via EventBrite: https://owasp-belgium-2018-02-20.eventbrite.com<br />
<br />
=== Coverage ===<br />
<br />
n/a</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_BeNeLux-Days_2018&diff=243457OWASP BeNeLux-Days 20182018-09-15T11:09:34Z<p>Sdeleersnyder: </p>
<hr />
<div><center>[[Image:Header-BNL-2018.png]]<br></center><br />
<br />
<br><!-- Header --><br />
<br />
<br />
<!-- First tab --><br />
= Information =<br />
== Keynote speaker ==<br />
{{#switchtablink:Conferenceday|<p><br />
* TBD<br />
}}<br />
<br />
== Confirmed speakers Conference ==<br />
{{#switchtablink:Conferenceday|<p><br />
* TBD<br />
}}<br />
<br />
== Confirmed trainers ==<br />
{{#switchtablink:Trainingday|<p><br />
* TBD<br />
}}<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
<br />
== The OWASP BeNeLux Program Committee ==<br />
*Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium<br />
*Martin Knobloch / Joren Poll, OWASP Netherlands<br />
*Jocelyn Aubert, OWASP Luxembourg<br />
<br><br />
<br />
== Tweet! ==<br />
Event tag is [http://twitter.com/#search?q=%23owaspbnl17 #owaspbnl18]<br />
<br><br><br />
== Donate to OWASP BeNeLux ==<br />
[https://co.clickandpledge.com/?wid=72689 Donate]<br />
<br />
<!-- Second tab --><br />
<br />
= Registration =<br />
<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
<!--<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
--><br />
<br />
== OWASP BeNeLux training is reserved for OWASP members, and registration is required! ==<br />
To support the OWASP organisation, we ask training attendees to consider becoming an OWASP member, it's only US$50!<br />
Check out the [[Membership]] page to find out more. <br />
<br />
<!--<br />
[https://owasp-benelux-day-2018.eventbrite.com Register now!]<br />
--><br />
<br><br />
To support the OWASP organisation, consider to become a member, it's only US$50!<br />
<br> <br />
Check out the [[Membership]] page to find out more. <br />
<br><br />
<br />
<br />
<!-- Third tab --><br />
<br />
= Venue =<br />
<br />
== Venue ==<br />
<br />
<br />
The venue is located:<br />
<br />
:'''TBD''' <br />
:TBD<br />
:TBD<br />
:Belgium<br />
:[https://goo.gl/maps/5CJYYSMAJD92 Google map]<br />
<br />
'''''Parking .....'''''<br />
<br />
=== How to reach the venue? ===<br />
;'''Public transport '''<br><br />
TBD<br />
<br />
'''<u>By car</u>'''<br />
TBD<br />
<br />
=== Hotel nearby ===<br />
[https://www.google.nl/maps/search/Hotels/@51.5571525,5.0821866,15z/data=!3m1!4b1 Hotels on Google Maps]<br />
<!-- Fourth tab --><br />
<br />
= Trainingday =<br />
=== Trainingday is November 29rd ===<br />
<br />
== Location ==<br />
<br />
== Agenda (TBD)==<br />
{| class="wikitable"<br />
! Time !! Description !! Room TBA !! Room TBA !! Room TBA<br />
|-<br />
| 08h30 - 9h30<br />
| colspan="5" style="text-align: center; background: grey; color: white;" | ''Registration''<br />
|-<br />
| 09h30 - 11h00 || Training<br />
| rowspan="7" style="width:100px;" | [[OWASP_BeNeLux-Day_2017#WebGoat_-_Teaching_application_security_101_by_Nanne_Baars | WebGoat - Teaching application security 101]] <br>by [[OWASP_BeNeLux-Day_2017#WebGoat_-_Teaching_application_security_101_by_Nanne_Baars | Nanne Baars]]<br />
| rowspan="7" style="width:100px;" | [[OWASP_BeNeLux-Day_2017#Whiteboard_Hacking_aka_Hands-on_Threat Modeling_by_Sebastien Deleersnyder | Whiteboard Hacking aka Hands-on Threat Modeling]] <br>by [[OWASP_BeNeLux-Day_2017#Whiteboard_Hacking_aka_Hands-on_Threat Modeling_by_Sebastien Deleersnyder | Sebastien Deleersnyder]]<br />
| rowspan="7" style="width:100px;" | [[OWASP_BeNeLux-Day_2017#Secure_Development:_Models_and_best_practices_by_Bart_De_Win | Secure Development: Models and best practices]] <br>by [[OWASP_BeNeLux-Day_2017#Secure_Development:_Models_and_best_practices_by_Bart_De_Win | Bart De Win]]<br />
|-<br />
| 11h00 - 11h30 || ''Coffee Break''<br />
|-<br />
| 11h30 - 13h00 || Training<br />
|-<br />
| 13h00 - 14h00 || ''Lunch''<br />
|-<br />
| 14h00 - 15h30 || Training<br />
|-<br />
| 15h30 - 16h00 || ''Coffee Break''<br />
|-<br />
| 16h00 - 17h30 || Training<br />
|}<br />
<br />
== Trainings ==<br />
=== WebGoat - Teaching application security 101 by Nanne Baars ===<br />
====Topic(s) ====<br />
* Web Application Breaker<br />
* Other<br />
====Keywords ====<br />
WebGoat application, security teaching secure development<br />
<br />
====Abstract ====<br />
A good defense against insecure code requires understanding the mechanics behind how attackers exploit simple programming mistakes.<br />
The WebGoat team will walk through exercises like SQL Injection, XSS, XXE, CSRF, ... and demonstrate how these exploits work.<br />
<br />
We will show you how you can use WebGoat to train your developers to avoid these simple but common programming mistakes.<br />
<br />
We also show you how to extend WebGoat to create lessons specific to your environment.<br />
Join us to learn the most basic, but common, application security problems.<br />
<br />
Tired of all the lessons? During the training we will host a small CTF competition which you can take a shot at and compete with each other...<br />
<br />
=== Requirements===<br />
Please find the course prerequisites here: https://github.com/nbaars/owasp-training<br />
<br />
====Bio====<br />
Nanne Baars works as a security consultant & developer at JDriven and is one of the primary developers of WebGoat.<br />
<br />
=== Whiteboard Hacking aka Hands-on Threat Modeling by Sebastien Deleersnyder ===<br />
====Topic(s) ====<br />
* Threat modeling introduction<br />
* Diagrams – what are you building?<br />
* Identifying threats – what can go wrong?<br />
* Hands-on: STRIDE analysis of an Internet of Things (IoT) deployment with an on premise gateway and secure update service<br />
* Addressing each threats<br />
* Hands-on: threat mitigations OAuth scenarios for web and mobile applications<br />
<br />
====Keywords ====<br />
Threat Modeling, STRIDE, Technical risk assessment<br />
<br />
====Abstract ====<br />
This is a one day version of our Black Hat training on Threat Modeling. The students will be challenged to perform practical threat modeling in groups of 3 to 4 people covering the different stages of threat modeling on:<br />
* An Internet of Things (IoT) deployment with an on premise gateway and secure update service<br />
* An HR services OAuth scenario for mobile and web applications <br />
Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. It also allows consideration of security issues at the component or application level. The threat modeling course will teach you to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model. <br><br />
This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications, databases & Single sign on (SSO) principles.<br />
<br />
<br />
====Bio====<br />
Sebastien (lead application security consultant Toreon) led engagements in the domain of ICT-security, Web and Mobile Security with several customers in the private and public sector. Sebastien is the Belgian OWASP Chapter Leader and is co-project leader of OWASP SAMM.<br />
<br />
=== Secure Development: Models and best practices by Bart De Win ===<br />
====Topic(s) ====<br />
* Software Assurance maturity models<br />
* Secure Development in agile development<br />
* Tips and tricks for practical SDLC<br />
* Hands-on: SAMM analysis of your enterprise using SAMM 1.5<br />
* Sneak preview of SAMM 2.0<br />
<br />
====Keywords ====<br />
SDLC, SAMM, Agile development, <br />
<br />
====Abstract ====<br />
It takes much more than a good developer to build secure software within an organisation. Indeed, building secure software is about ensuring that security is taken into consideration during the entire software lifecycle. It is about ensuring that security best practices are being employed efficiently, and that uncovered risks are appropriately dealt with in due time.<br />
<br />
During this one-day training, we will introduce and discuss different secure development approaches and models. We will look into waterfall vs. agile development and discuss different strategies to successfully run an SDLC program. Finally, we will also put theorie into practice and take your organisation to perform a mini SDLC assessment and improvement exercise.<br />
[[File:Benelux2017 - Secure Development Training deck.pdf|thumb]]<br />
The slides of this session are available for download in the media file.<br />
<br />
====Bio====<br />
Bart is an application security consultant and enthousiast and is spending considerable time on secure development projects. Bart is board member of the Belgian OWASP Chapter and is co-project leader of OWASP SAMM.<br />
<br />
<br />
<!-- Fifth tab --><br />
<br />
= Conferenceday =<br />
=== Conferenceday is November 30th ===<br />
<br />
<br />
== Agenda (TBD)==<br />
{| class="wikitable"<br />
! width="120pt" | Time<br />
! width="190pt" | Speaker <br />
! width="400pt" | Topic<br />
! width="100pt" -- ! | Media<br />
|- <br />
| 08h30 - 09h00<br />
| colspan="3" style="text-align: center; background: grey; color: white" | ''Registration''<br />
|- <br />
| 09h00 - 09h15<br />
| colspan="3" style="text-align: center; background: grey; color: white" | ''Opening''<br />
|- <br />
| 09h15 - 10h00 || [[OWASP_BeNeLux-Day_2017#Attribute Based Access Control. Why, what, how? by Jacoba Sieders | Jacoba Sieders]]<br />
|| [[OWASP_BeNeLux-Day_2017#Attribute Based Access Control. Why, what, how? by Jacoba Sieders | Attribute Based Access Control. Why, what, how?]] <br />
|| [[Media:OWASP BeNeLux-Day 2017 AttributeBasedAccessControl WhyWhatHow JacobaSieders.pdf|Slides]]<br>[https://youtu.be/O7iWITnZGsk Video]<br />
|-<br />
| 10h00 - 10h45 || [[OWASP_BeNeLux-Day_2017#How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil by Matia Madou | Matias Madou]]<br />
|| [[OWASP_BeNeLux-Day_2017#How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil by Matia Madou | How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil]]<br />
|| [[Media:OWASP_BeNeLux-Day_2017_how_to_spend_$3.6_mil_on_one_coding_mistake_by_Matias_Madou.pdf|Slides]] <br> [https://www.youtube.com/watch?v=dt5rFGBztJA&feature=youtu.be Video]<br />
<br />
|-<br />
| 10h45 - 11h15 <br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Morning Break'' <br />
|-<br />
| 11h15 - 12h00 || [[OWASP_BeNeLux-Day_2017#The evil friend in your browser by Achim D. Brucker | Achim D. Brucker]]<br />
|| [[OWASP_BeNeLux-Day_2017#The evil friend in your browser by Achim D. Brucker | The evil friend in your browser]]<br />
| [[Media:OWASP_BeNeLux-Day_2017_The evil friend in your browser_Achim_Brucker.pdf|Slides]]<br>[https://www.youtube.com/watch?v=_Uj-Ci37Rvw&feature=youtu.be Video]<br />
|-<br />
| 12h00 - 12h45 || [[OWASP_BeNeLux-Day_2017#Exploring the ecosystem of malicious domain registrations in the .eu TLD by Lieven Desmet | Lieven Desmet]]<br />
|| [[OWASP_BeNeLux-Day_2017#Exploring the ecosystem of malicious domain registrations in the .eu TLD by Lieven Desmet | Exploring the ecosystem of malicious domain registrations in the .eu TLD]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Exploring the ecosystem of malicious domain registrations LievenDesmet.pdf|Slides]]<br>[https://www.youtube.com/watch?v=09SNSYHw8H0&feature=youtu.be Video]<br />
|-<br />
| 12h45 - 13h45<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Lunch'' <br />
|-<br />
| 13h45 - 14h30 || [[OWASP_BeNeLux-Day_2017#Don't trust the DOM: Bypassing XSS mitigations via script gadgets by Sebastian Lekies | Sebastian Lekies]]<br />
|| [[OWASP_BeNeLux-Day_2017#Don't trust the DOM: Bypassing XSS mitigations via script gadgets by Sebastian Lekies | Don't trust the DOM: Bypassing XSS mitigations via script gadgets]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Bypassing XSS mitigations via script gadgets Sebastian Lekies.pdf|Slides]]<br>[https://www.youtube.com/watch?v=rssg--FP1AE&feature=youtu.be Video]<br />
|-<br />
| 14h30 - 15h15 || [[OWASP_BeNeLux-Day_2017#A Series of Unfortunate Events: Where Malware Meets Murphy by Mattijs van Ommeren | Mattijs van Ommeren]]<br />
|| [[OWASP_BeNeLux-Day_2017#A Series of Unfortunate Events: Where Malware Meets Murphy by Mattijs van Ommeren | A Series of Unfortunate Events: Where Malware Meets Murphy]]<br />
| <!--[[Media:OWASP_Benelux-Day_2017_A_Series_Of_Unfortunate_Events-Where_Malware_Meets_Murphy_Mattijs_van_Ommeren.pdf|Slides]]<br> -->[https://www.youtube.com/watch?v=d67yxt3FdTA&feature=youtu.be Video]<br />
|-<br />
| 15h15 - 15h45<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Break'' <br />
|-<br />
| 15h45 - 16h30 || [[OWASP_BeNeLux-Day_2017#Common REST API security pitfalls by Philippe De Ryck | Philippe De Ryck]]<br />
|| [[OWASP_BeNeLux-Day_2017#Common REST API security pitfalls by Philippe De Ryck | Common REST API security pitfalls]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Common REST API security pitfalls Philippe De Ryck.pdf|Slides]]<br>[https://www.youtube.com/watch?v=Meh4EUmLCfM&feature=youtu.be Video]<br />
|-<br />
| 16h30 - 17h15 || [[OWASP_BeNeLux-Day_2017#Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded by Jeroen Willemsen | Jeroen Willemsen]]<br />
|| [[OWASP_BeNeLux-Day_2017#Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded by Jeroen Willemsen | Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded Jeroen Willemsen.pdf|Slides]]<br>[https://www.youtube.com/watch?v=Q3q1mdev5rs&feature=youtu.be Video]<br />
|-<br />
| 17h15 - 17h30<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Closing'' <br />
|}<br />
<br />
<div id="TBD"></div><br />
<br />
== Talks == <br />
<br />
===Attribute Based Access Control. Why, what, how? by Jacoba Sieders===<br />
====Abstract====<br />
Digitization is rapidly transforming the traditional world and regulation on security and data protection is gaining weight. Digital identity, but also data protection become crucial capabilities for businesses. What are the trends in IAM and what role can Attribute Based Access Control (ABAC) play here? ABNAMRO started implementing ABAC in 2014. What were the approach and the lessons learnt?<br />
====Bio====<br />
Jacoba Sieders, Head of Digital Identity- & Access, ABNAMRO Bank.<br /><br />
Jacoba is an all-round Digital Identity and Information Security expert with 17 years of experience in the international finance industry, in technology, governance, consultancy, and implementation. She is accountable for digital identity services and access control for customers, employees and partners to the bank’s data and infrastructure. <br />
Major topics on her agenda today are ABAC, data centric security, API-banking and PSDII requirements, the interaction of IAM tools with the rest of the bank’s cybersecurity landscape, and the new authentication concept for which ABNAMRO is acquiring a patent. Her special interests are legal requirements impacting identity, e.g. Generic Data Protection Regulation, the EU e-IDAS scheme, KYC and AML legislation. <br />
Jacoba is a member of the Advisory Board of the independent European think-tank ID Next and is regularly speaking on the topic of IAM. She holds a master degree in Classics from Leiden University (Greek, Latin, Hebrew). <br />
<br />
<br />
===How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil by Matia Madou===<br />
====Abstract====<br />
In a recent global study, the average cost of a data breach is $3.62M globally. This session will discuss infamous examples of data breaches that has made headlines around the world. We will explore the technical details of the vulnerability itself and what a coding solution may have been to prevent the breach. We will also dive deeper on exploring different solutions, processes and techniques you can apply in your day-to-day to prevent application security vulnerabilities in your code.<br />
====Bio====<br />
Matias Madou is a Co-Founder and CTO of Secure Code Warrior where he is responsible for leading the company’s technology vision and overseeing the engineering team. Matias has more than 15 years of hands-on software security experience and has developed solution for companies such as HP Fortify, and founded a company called Sensei Security. Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon. Matias holds a Ph.D. in Computer Engineering from Ghent University.<br />
<br />
<br />
===The evil friend in your browser by Achim D. Brucker===<br />
====Abstract====<br />
On the one hand, browser extensions, e.g., for Chrome, are very useful, as they extend web browsers with additional functionality<br />
(e.g., blocking ads). On the other hand, they are the most dangerous code that runs in your browsers: extension can read and modify both the content displayed in the browser. As they also can communicate with any web-site or web-service, they can report both data and metadata to external parties.<br />
<br />
The current security model for browser extensions seems to be inadequate for expressing the security or privacy needs of browser users. Consequently, browser extensions are a "juice target" for attackers targeting web users.<br />
<br />
We present results of analysing over 60000 browser extensions on how they use the current security model and discuss examples of extensions that are potentially of high risk. Based on the results of our analysis of real world browser extensions as well as our own threat model, we discuss the limitations of the current security model form a user perspective. need of browser users.<br />
<br />
====Bio====<br />
Dr. Achim D. Brucker (www.brucker.uk) is a Senior Lecturer and consultant for software and systems assurance at the Computer Science Department of The University of Sheffield, UK. Until December 2015, he was a Research Expert (Architect), Security Testing Strategist, and Project Lead in the Global Security Team of SAP SE, where he defined the risk-based security testing strategy of SAP that combines static, dynamic, and interactive security testing methods and integrates them deeply into SAP's Secure Software Development Lifecycle. He has experience in rolling out *AST tools to world-wide development organisations.<br />
<br />
===Exploring the ecosystem of malicious domain registrations in the .eu TLD by Lieven Desmet===<br />
====Abstract====<br />
In this talk, we report on an extensive analysis of 14 months of domain registration in the .eu TLD. The purpose is to identify large-scale malicious campaigns. Overall, the dataset of this study contains 824,121 new domain registrations; 2.53% of which have been flagged as malicious by blacklisting services. We explore the ecosystem and modus operandi of elaborate cybercriminal entities that recurrently register large amounts of domains for one-shot, malicious use. Although these malicious domains are short-lived, we establish that at least 80.04% of them can be framed in to 20 larger campaigns with varying duration and intensity. We further report on insights in the operational aspects of this business and observe, amongst other findings, that their processes are only partially automated. <br />
====Bio====<br />
Lieven Desmet is a Senior Research Manager on Secure Software in the imec-DistriNet Research Group at the Katholieke Universiteit Leuven (Belgium), where he outlines and implements the research strategy, coaches junior researchers in application security, and participates in dissemination, valorisation and spin-off activities. Lieven is also involved in OWASP as a board member of the Belgium OWASP Chapter, and part of the organisation team of the OWASP BeNeLux Day.<br />
<br />
===Don't trust the DOM: Bypassing XSS mitigations via script gadgets by Sebastian Lekies===<br />
====Abstract====<br />
Cross-Site Scripting is a constant problem of the Web platform. Over the years many techniques have been introduced to prevent or mitigate XSS. Most of these techniques, thereby, focus on script tags and event handlers. HTML sanitizers, for example, aim at removing potentially dangerous tags and attributes. Another example is the Content Security Policy, which forbids inline event handlers and aims at white listing of legitimate scripts.<br />
<br />
In this talk, we present a novel Web hacking technique that enables an attacker to circumvent most XSS mitigations. In order to do so, the attacker abuses so-called script gadgets. A script gadget Is a legitimate piece of JavaScript in a page that reads elements from the DOM via selectors and processes them in a way that results in script execution. To abuse a script gadget, the attacker injects a benign looking element into the page that matches the gadget's selector. Subsequently, the gadget selects the benign-looking element and executes attacker-controlled scripts. As the initially injected element is benign it passes HTML sanitizers and security policies. The XSS only surfaces when the gadget mistakenly elevates the privileges of the element.<br />
<br />
In this talk, we will demonstrate that these gadgets are present in almost all modern JavaScript libraries, APIs and applications. We will present several case studies and real-world examples that demonstrate that many mitigation techniques are not suited for modern applications. As a result, we argue that the Web should start focusing more on preventive mechanisms instead of mitigations.<br />
====Bio====<br />
Sebastian Lekies is tech leading the Web application security scanning team at Google. Before joining Google, he was part of SAP's Security Research team, where he conducted academic research in the area of client-side Web application security. Sebastian is regularly speaking at academic and non-academic security conferences such as BlackHat US/EU/Asia, DeepSec, OWASP AppSec EU, Usenix Security, CCS, and many more...<br />
<br />
<br />
===A Series of Unfortunate Events: Where Malware Meets Murphy by Mattijs van Ommeren===<br />
====Abstract====<br />
When an end user reports some “strange looking file names”, which, after investigating, you discover include several hundreds of Gigabytes of encrypted data, you of course know you are going to have a bad day. Your AV solution has failed you, your firewall has failed you, and your SIEM has failed you. Basically, every piece of security infrastructure you have put your trust (and money) into has left you out in the cold and you thank <deity of choice> that at least the nightly backup was completed successfully. Spin up the tape drive, and soon you will be back in business, or not…?<br />
<br />
This talk is about failure. Not only about a failing security infrastructure, but also about failure in doing the Right Thing™ as a first responder, about the failure of Operating System tools, failing APIs, and ironically, also the failure of malware (which is unfortunately not as positive as it may sound). The scenario presented comes pretty close to the worst chain of events you can imagine, in an attempt to recover from a ransomware incident.<br />
<br />
Luckily – this story has a happy ending. We will reveal how one can be prepared for when both Count Olaf and Murphy come knocking on your door simultaneously.<br />
====Bio====<br />
Mattijs van Ommeren has been poking hardware and software for 15 years. He has spent most of his working life as a security consultant, attacking and defending both traditional IT environments as well as more esoteric embedded devices and industrial systems. Presently he has a lot of fun at Nixu.<br />
<br />
<br />
===Common REST API security pitfalls by Philippe De Ryck===<br />
====Abstract====<br />
The shift towards a REST API landscape indicates a significant evolution in the way we build applications. The rise of JavaScript and mobile applications have sparked an explosion of easily-accessible REST APIs. But how do you protect access to your API? Which security aspects are no longer relevant? Which security features are an absolutely must-have, and which additional security measures do you need to take into account?<br />
<br />
These are hard questions, as evidenced by the deployment of numerous insecure REST APIs. Attend this session to find out about common API security pitfalls, that often result in compromised user accounts and unauthorized access to your data. We expose the problem that lies at the root of each of these pitfalls, and offer actionable advice to address these security problems. After this session, you will know how to assess the security of your APIs, and the best practices to improve them towards the future.<br />
====Bio====<br />
Philippe De Ryck is a professional speaker and trainer on software security and web security. Since he obtained his PhD at the imec-DistriNet research group (KU Leuven, Belgium), he has been running the group's Web Security Training program, which ensures a sustainable knowledge transfer of the group’s security expertise towards practitioners.<br />
<br />
<br />
===Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded by Jeroen Willemsen===<br />
====Abstract====<br />
Join us on our adventure of setting up a appsec pipeline with Docker containers. What did go wrong, how did we succeed? How do you fight false positives and how do you get the best out of the products out there without bothering the development teams too much.<br />
====Bio====<br />
Jeroen Willemsen is a security architect with a passion for mobile and risk management. He loves to work on secure building blocks, security automation pipelines and embedding information security risk management controls in an agile environment. He is dedicated to help developers, product owners and architects to take security seriously in their daily development life (but not too serious of course ;-)).In his spare time he loves to experiment with new technologies and frameworks.”<br />
<br />
<br />
<!-- Sixth tab --><br />
<br />
= Social Event (TBD)=<br />
<br />
== Social Event,starting at 7PM ==<br />
Thursday, November 23rd<br />
;Dudok Tilburg<br />
:Veemarktstraat 33<br />
:5038 CT Tilburg<br />
:http://www.dudok.nl/<br />
Menu:<br />
:As we are a big group, Dudok will prepare the following [[Media:Dudok menu OWASP.pdf|menu]] for us!<br />
'''If you want to join the social event, don't forget to register for the social event via the registration:'''<br />
:[[image:Register_now_red.png|link=https://owasp-benelux-day-2017.eventbrite.com |200px|alt=Register for the OWASP BeNeLux Day 2017 | Register for the OWASP BeNeLux Day 2017 ]]<br />
<br />
<br />
(limited) open tap sponsored by :<br />
[[File:Avi Logo Transparent Background 300pix.png|200px|link=https://avinetworks.com/]] <br />
<br />
<!-- Seventh tab --><br />
<br />
= Sponsor =<br />
<br />
=== Become a sponsor of OWASP BeNeLux ===<br />
<br />
There are 3 combined sponsorship packages (Gold, Silver or Bronze) that cover the BeNeLux chapter meetings 2019 and the BeNeLux OWASP Days 2018.<br />
<br />
Download our sponsor brochure TBD and contact [mailto:seba@owasp.org us] for questions or sponsorship confirmation!<br />
<br />
Your sponsorship will be invested directly in the chapter meetings, supporting speaker and catering expenses. <br />
<br />
The sponsorship will also be dedicated to cover the costs of the OWASP 2018 BeNeLux event.<br />
<br />
<!-- Don't remove these two lines! -->__NOTOC__ <br />
<headertabs></headertabs><br />
<br />
<br />
<br />
=== Made possible by our {{#switchtablink:Sponsor|Sponsors}}===<br />
'''Hosted by'''<br />
<br />
<br />
'''Platinum:'''<br />
<br />
<br />
'''Gold:'''<br />
<br />
<br />
'''Silver:'''<br />
<br />
<br />
'''Bronze:'''<br />
<br />
<br />
[[Category:OWASP_AppSec_Conference]] <br />
[[Category:OWASP_BeNeLux_Archives]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=File:Header-BNL-2018.png&diff=243454File:Header-BNL-2018.png2018-09-15T05:30:01Z<p>Sdeleersnyder: </p>
<hr />
<div></div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_BeNeLux-Days_2018&diff=243171OWASP BeNeLux-Days 20182018-09-05T04:45:26Z<p>Sdeleersnyder: Created page with "<center>Image:Header-BNL-2017.png<br></center> <br><!-- Header --> <!-- First tab --> = Information = == Keynote speaker == {{#switchtablink:Conferenceday|<p> * TBD }..."</p>
<hr />
<div><center>[[Image:Header-BNL-2017.png]]<br></center><br />
<br />
<br><!-- Header --><br />
<br />
<br />
<!-- First tab --><br />
= Information =<br />
== Keynote speaker ==<br />
{{#switchtablink:Conferenceday|<p><br />
* TBD<br />
}}<br />
<br />
== Confirmed speakers Conference ==<br />
{{#switchtablink:Conferenceday|<p><br />
* TBD<br />
}}<br />
<br />
== Confirmed trainers ==<br />
{{#switchtablink:Trainingday|<p><br />
* TBD<br />
}}<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
<br />
== The OWASP BeNeLux Program Committee ==<br />
*Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium<br />
*Martin Knobloch / Joren Poll, OWASP Netherlands<br />
*Jocelyn Aubert, OWASP Luxembourg<br />
<br><br />
<br />
== Tweet! ==<br />
Event tag is [http://twitter.com/#search?q=%23owaspbnl17 #owaspbnl18]<br />
<br><br><br />
== Donate to OWASP BeNeLux ==<br />
[https://co.clickandpledge.com/?wid=72689 Donate]<br />
<br />
<!-- Second tab --><br />
<br />
= Registration =<br />
<br />
<br />
== OWASP BeNeLux conference is free, but registration is required! ==<br />
[[image:Register_now_red.png|link=https://owasp-benelux-day-2018.eventbrite.com |alt=Register for the OWASP BeNeLux Day 2018 | Register for the OWASP BeNeLux Day 2018 ]]<br />
<br />
== OWASP BeNeLux training is reserved for OWASP members, and registration is required! ==<br />
To support the OWASP organisation, we ask training attendees to consider becoming an OWASP member, it's only US$50!<br />
Check out the [[Membership]] page to find out more. <br />
<br />
<!--<br />
[https://owasp-benelux-day-2018.eventbrite.com Register now!]<br />
--><br />
<br><br />
To support the OWASP organisation, consider to become a member, it's only US$50!<br />
<br> <br />
Check out the [[Membership]] page to find out more. <br />
<br><br />
<br />
<br />
<!-- Third tab --><br />
<br />
= Venue =<br />
<br />
== Venue ==<br />
<br />
<br />
The venue is located:<br />
<br />
:'''TBD''' <br />
:TBD<br />
:TBD<br />
:Belgium<br />
:[https://goo.gl/maps/5CJYYSMAJD92 Google map]<br />
<br />
'''''Parking .....'''''<br />
<br />
=== How to reach the venue? ===<br />
;'''Public transport '''<br><br />
TBD<br />
<br />
'''<u>By car</u>'''<br />
TBD<br />
<br />
=== Hotel nearby ===<br />
[https://www.google.nl/maps/search/Hotels/@51.5571525,5.0821866,15z/data=!3m1!4b1 Hotels on Google Maps]<br />
<!-- Fourth tab --><br />
<br />
= Trainingday =<br />
=== Trainingday is November 29rd ===<br />
<br />
== Location ==<br />
<br />
== Agenda (TBD)==<br />
{| class="wikitable"<br />
! Time !! Description !! Room TBA !! Room TBA !! Room TBA<br />
|-<br />
| 08h30 - 9h30<br />
| colspan="5" style="text-align: center; background: grey; color: white;" | ''Registration''<br />
|-<br />
| 09h30 - 11h00 || Training<br />
| rowspan="7" style="width:100px;" | [[OWASP_BeNeLux-Day_2017#WebGoat_-_Teaching_application_security_101_by_Nanne_Baars | WebGoat - Teaching application security 101]] <br>by [[OWASP_BeNeLux-Day_2017#WebGoat_-_Teaching_application_security_101_by_Nanne_Baars | Nanne Baars]]<br />
| rowspan="7" style="width:100px;" | [[OWASP_BeNeLux-Day_2017#Whiteboard_Hacking_aka_Hands-on_Threat Modeling_by_Sebastien Deleersnyder | Whiteboard Hacking aka Hands-on Threat Modeling]] <br>by [[OWASP_BeNeLux-Day_2017#Whiteboard_Hacking_aka_Hands-on_Threat Modeling_by_Sebastien Deleersnyder | Sebastien Deleersnyder]]<br />
| rowspan="7" style="width:100px;" | [[OWASP_BeNeLux-Day_2017#Secure_Development:_Models_and_best_practices_by_Bart_De_Win | Secure Development: Models and best practices]] <br>by [[OWASP_BeNeLux-Day_2017#Secure_Development:_Models_and_best_practices_by_Bart_De_Win | Bart De Win]]<br />
|-<br />
| 11h00 - 11h30 || ''Coffee Break''<br />
|-<br />
| 11h30 - 13h00 || Training<br />
|-<br />
| 13h00 - 14h00 || ''Lunch''<br />
|-<br />
| 14h00 - 15h30 || Training<br />
|-<br />
| 15h30 - 16h00 || ''Coffee Break''<br />
|-<br />
| 16h00 - 17h30 || Training<br />
|}<br />
<br />
== Trainings ==<br />
=== WebGoat - Teaching application security 101 by Nanne Baars ===<br />
====Topic(s) ====<br />
* Web Application Breaker<br />
* Other<br />
====Keywords ====<br />
WebGoat application, security teaching secure development<br />
<br />
====Abstract ====<br />
A good defense against insecure code requires understanding the mechanics behind how attackers exploit simple programming mistakes.<br />
The WebGoat team will walk through exercises like SQL Injection, XSS, XXE, CSRF, ... and demonstrate how these exploits work.<br />
<br />
We will show you how you can use WebGoat to train your developers to avoid these simple but common programming mistakes.<br />
<br />
We also show you how to extend WebGoat to create lessons specific to your environment.<br />
Join us to learn the most basic, but common, application security problems.<br />
<br />
Tired of all the lessons? During the training we will host a small CTF competition which you can take a shot at and compete with each other...<br />
<br />
=== Requirements===<br />
Please find the course prerequisites here: https://github.com/nbaars/owasp-training<br />
<br />
====Bio====<br />
Nanne Baars works as a security consultant & developer at JDriven and is one of the primary developers of WebGoat.<br />
<br />
=== Whiteboard Hacking aka Hands-on Threat Modeling by Sebastien Deleersnyder ===<br />
====Topic(s) ====<br />
* Threat modeling introduction<br />
* Diagrams – what are you building?<br />
* Identifying threats – what can go wrong?<br />
* Hands-on: STRIDE analysis of an Internet of Things (IoT) deployment with an on premise gateway and secure update service<br />
* Addressing each threats<br />
* Hands-on: threat mitigations OAuth scenarios for web and mobile applications<br />
<br />
====Keywords ====<br />
Threat Modeling, STRIDE, Technical risk assessment<br />
<br />
====Abstract ====<br />
This is a one day version of our Black Hat training on Threat Modeling. The students will be challenged to perform practical threat modeling in groups of 3 to 4 people covering the different stages of threat modeling on:<br />
* An Internet of Things (IoT) deployment with an on premise gateway and secure update service<br />
* An HR services OAuth scenario for mobile and web applications <br />
Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. It also allows consideration of security issues at the component or application level. The threat modeling course will teach you to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model. <br><br />
This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications, databases & Single sign on (SSO) principles.<br />
<br />
<br />
====Bio====<br />
Sebastien (lead application security consultant Toreon) led engagements in the domain of ICT-security, Web and Mobile Security with several customers in the private and public sector. Sebastien is the Belgian OWASP Chapter Leader and is co-project leader of OWASP SAMM.<br />
<br />
=== Secure Development: Models and best practices by Bart De Win ===<br />
====Topic(s) ====<br />
* Software Assurance maturity models<br />
* Secure Development in agile development<br />
* Tips and tricks for practical SDLC<br />
* Hands-on: SAMM analysis of your enterprise using SAMM 1.5<br />
* Sneak preview of SAMM 2.0<br />
<br />
====Keywords ====<br />
SDLC, SAMM, Agile development, <br />
<br />
====Abstract ====<br />
It takes much more than a good developer to build secure software within an organisation. Indeed, building secure software is about ensuring that security is taken into consideration during the entire software lifecycle. It is about ensuring that security best practices are being employed efficiently, and that uncovered risks are appropriately dealt with in due time.<br />
<br />
During this one-day training, we will introduce and discuss different secure development approaches and models. We will look into waterfall vs. agile development and discuss different strategies to successfully run an SDLC program. Finally, we will also put theorie into practice and take your organisation to perform a mini SDLC assessment and improvement exercise.<br />
[[File:Benelux2017 - Secure Development Training deck.pdf|thumb]]<br />
The slides of this session are available for download in the media file.<br />
<br />
====Bio====<br />
Bart is an application security consultant and enthousiast and is spending considerable time on secure development projects. Bart is board member of the Belgian OWASP Chapter and is co-project leader of OWASP SAMM.<br />
<br />
<br />
<!-- Fifth tab --><br />
<br />
= Conferenceday =<br />
=== Conferenceday is November 30th ===<br />
<br />
<br />
== Agenda (TBD)==<br />
{| class="wikitable"<br />
! width="120pt" | Time<br />
! width="190pt" | Speaker <br />
! width="400pt" | Topic<br />
! width="100pt" -- ! | Media<br />
|- <br />
| 08h30 - 09h00<br />
| colspan="3" style="text-align: center; background: grey; color: white" | ''Registration''<br />
|- <br />
| 09h00 - 09h15<br />
| colspan="3" style="text-align: center; background: grey; color: white" | ''Opening''<br />
|- <br />
| 09h15 - 10h00 || [[OWASP_BeNeLux-Day_2017#Attribute Based Access Control. Why, what, how? by Jacoba Sieders | Jacoba Sieders]]<br />
|| [[OWASP_BeNeLux-Day_2017#Attribute Based Access Control. Why, what, how? by Jacoba Sieders | Attribute Based Access Control. Why, what, how?]] <br />
|| [[Media:OWASP BeNeLux-Day 2017 AttributeBasedAccessControl WhyWhatHow JacobaSieders.pdf|Slides]]<br>[https://youtu.be/O7iWITnZGsk Video]<br />
|-<br />
| 10h00 - 10h45 || [[OWASP_BeNeLux-Day_2017#How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil by Matia Madou | Matias Madou]]<br />
|| [[OWASP_BeNeLux-Day_2017#How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil by Matia Madou | How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil]]<br />
|| [[Media:OWASP_BeNeLux-Day_2017_how_to_spend_$3.6_mil_on_one_coding_mistake_by_Matias_Madou.pdf|Slides]] <br> [https://www.youtube.com/watch?v=dt5rFGBztJA&feature=youtu.be Video]<br />
<br />
|-<br />
| 10h45 - 11h15 <br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Morning Break'' <br />
|-<br />
| 11h15 - 12h00 || [[OWASP_BeNeLux-Day_2017#The evil friend in your browser by Achim D. Brucker | Achim D. Brucker]]<br />
|| [[OWASP_BeNeLux-Day_2017#The evil friend in your browser by Achim D. Brucker | The evil friend in your browser]]<br />
| [[Media:OWASP_BeNeLux-Day_2017_The evil friend in your browser_Achim_Brucker.pdf|Slides]]<br>[https://www.youtube.com/watch?v=_Uj-Ci37Rvw&feature=youtu.be Video]<br />
|-<br />
| 12h00 - 12h45 || [[OWASP_BeNeLux-Day_2017#Exploring the ecosystem of malicious domain registrations in the .eu TLD by Lieven Desmet | Lieven Desmet]]<br />
|| [[OWASP_BeNeLux-Day_2017#Exploring the ecosystem of malicious domain registrations in the .eu TLD by Lieven Desmet | Exploring the ecosystem of malicious domain registrations in the .eu TLD]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Exploring the ecosystem of malicious domain registrations LievenDesmet.pdf|Slides]]<br>[https://www.youtube.com/watch?v=09SNSYHw8H0&feature=youtu.be Video]<br />
|-<br />
| 12h45 - 13h45<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Lunch'' <br />
|-<br />
| 13h45 - 14h30 || [[OWASP_BeNeLux-Day_2017#Don't trust the DOM: Bypassing XSS mitigations via script gadgets by Sebastian Lekies | Sebastian Lekies]]<br />
|| [[OWASP_BeNeLux-Day_2017#Don't trust the DOM: Bypassing XSS mitigations via script gadgets by Sebastian Lekies | Don't trust the DOM: Bypassing XSS mitigations via script gadgets]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Bypassing XSS mitigations via script gadgets Sebastian Lekies.pdf|Slides]]<br>[https://www.youtube.com/watch?v=rssg--FP1AE&feature=youtu.be Video]<br />
|-<br />
| 14h30 - 15h15 || [[OWASP_BeNeLux-Day_2017#A Series of Unfortunate Events: Where Malware Meets Murphy by Mattijs van Ommeren | Mattijs van Ommeren]]<br />
|| [[OWASP_BeNeLux-Day_2017#A Series of Unfortunate Events: Where Malware Meets Murphy by Mattijs van Ommeren | A Series of Unfortunate Events: Where Malware Meets Murphy]]<br />
| <!--[[Media:OWASP_Benelux-Day_2017_A_Series_Of_Unfortunate_Events-Where_Malware_Meets_Murphy_Mattijs_van_Ommeren.pdf|Slides]]<br> -->[https://www.youtube.com/watch?v=d67yxt3FdTA&feature=youtu.be Video]<br />
|-<br />
| 15h15 - 15h45<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Break'' <br />
|-<br />
| 15h45 - 16h30 || [[OWASP_BeNeLux-Day_2017#Common REST API security pitfalls by Philippe De Ryck | Philippe De Ryck]]<br />
|| [[OWASP_BeNeLux-Day_2017#Common REST API security pitfalls by Philippe De Ryck | Common REST API security pitfalls]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Common REST API security pitfalls Philippe De Ryck.pdf|Slides]]<br>[https://www.youtube.com/watch?v=Meh4EUmLCfM&feature=youtu.be Video]<br />
|-<br />
| 16h30 - 17h15 || [[OWASP_BeNeLux-Day_2017#Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded by Jeroen Willemsen | Jeroen Willemsen]]<br />
|| [[OWASP_BeNeLux-Day_2017#Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded by Jeroen Willemsen | Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded]]<br />
| [[Media:OWASP BeNeLux-Day 2017 Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded Jeroen Willemsen.pdf|Slides]]<br>[https://www.youtube.com/watch?v=Q3q1mdev5rs&feature=youtu.be Video]<br />
|-<br />
| 17h15 - 17h30<br />
| colspan="3" style="text-align: center;background: grey; color: white" | ''Closing'' <br />
|}<br />
<br />
<div id="TBD"></div><br />
<br />
== Talks == <br />
<br />
===Attribute Based Access Control. Why, what, how? by Jacoba Sieders===<br />
====Abstract====<br />
Digitization is rapidly transforming the traditional world and regulation on security and data protection is gaining weight. Digital identity, but also data protection become crucial capabilities for businesses. What are the trends in IAM and what role can Attribute Based Access Control (ABAC) play here? ABNAMRO started implementing ABAC in 2014. What were the approach and the lessons learnt?<br />
====Bio====<br />
Jacoba Sieders, Head of Digital Identity- & Access, ABNAMRO Bank.<br /><br />
Jacoba is an all-round Digital Identity and Information Security expert with 17 years of experience in the international finance industry, in technology, governance, consultancy, and implementation. She is accountable for digital identity services and access control for customers, employees and partners to the bank’s data and infrastructure. <br />
Major topics on her agenda today are ABAC, data centric security, API-banking and PSDII requirements, the interaction of IAM tools with the rest of the bank’s cybersecurity landscape, and the new authentication concept for which ABNAMRO is acquiring a patent. Her special interests are legal requirements impacting identity, e.g. Generic Data Protection Regulation, the EU e-IDAS scheme, KYC and AML legislation. <br />
Jacoba is a member of the Advisory Board of the independent European think-tank ID Next and is regularly speaking on the topic of IAM. She holds a master degree in Classics from Leiden University (Greek, Latin, Hebrew). <br />
<br />
<br />
===How to spend $3.6mil on one coding mistake, and other fun stuff you can do with $3.6mil by Matia Madou===<br />
====Abstract====<br />
In a recent global study, the average cost of a data breach is $3.62M globally. This session will discuss infamous examples of data breaches that has made headlines around the world. We will explore the technical details of the vulnerability itself and what a coding solution may have been to prevent the breach. We will also dive deeper on exploring different solutions, processes and techniques you can apply in your day-to-day to prevent application security vulnerabilities in your code.<br />
====Bio====<br />
Matias Madou is a Co-Founder and CTO of Secure Code Warrior where he is responsible for leading the company’s technology vision and overseeing the engineering team. Matias has more than 15 years of hands-on software security experience and has developed solution for companies such as HP Fortify, and founded a company called Sensei Security. Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon. Matias holds a Ph.D. in Computer Engineering from Ghent University.<br />
<br />
<br />
===The evil friend in your browser by Achim D. Brucker===<br />
====Abstract====<br />
On the one hand, browser extensions, e.g., for Chrome, are very useful, as they extend web browsers with additional functionality<br />
(e.g., blocking ads). On the other hand, they are the most dangerous code that runs in your browsers: extension can read and modify both the content displayed in the browser. As they also can communicate with any web-site or web-service, they can report both data and metadata to external parties.<br />
<br />
The current security model for browser extensions seems to be inadequate for expressing the security or privacy needs of browser users. Consequently, browser extensions are a "juice target" for attackers targeting web users.<br />
<br />
We present results of analysing over 60000 browser extensions on how they use the current security model and discuss examples of extensions that are potentially of high risk. Based on the results of our analysis of real world browser extensions as well as our own threat model, we discuss the limitations of the current security model form a user perspective. need of browser users.<br />
<br />
====Bio====<br />
Dr. Achim D. Brucker (www.brucker.uk) is a Senior Lecturer and consultant for software and systems assurance at the Computer Science Department of The University of Sheffield, UK. Until December 2015, he was a Research Expert (Architect), Security Testing Strategist, and Project Lead in the Global Security Team of SAP SE, where he defined the risk-based security testing strategy of SAP that combines static, dynamic, and interactive security testing methods and integrates them deeply into SAP's Secure Software Development Lifecycle. He has experience in rolling out *AST tools to world-wide development organisations.<br />
<br />
===Exploring the ecosystem of malicious domain registrations in the .eu TLD by Lieven Desmet===<br />
====Abstract====<br />
In this talk, we report on an extensive analysis of 14 months of domain registration in the .eu TLD. The purpose is to identify large-scale malicious campaigns. Overall, the dataset of this study contains 824,121 new domain registrations; 2.53% of which have been flagged as malicious by blacklisting services. We explore the ecosystem and modus operandi of elaborate cybercriminal entities that recurrently register large amounts of domains for one-shot, malicious use. Although these malicious domains are short-lived, we establish that at least 80.04% of them can be framed in to 20 larger campaigns with varying duration and intensity. We further report on insights in the operational aspects of this business and observe, amongst other findings, that their processes are only partially automated. <br />
====Bio====<br />
Lieven Desmet is a Senior Research Manager on Secure Software in the imec-DistriNet Research Group at the Katholieke Universiteit Leuven (Belgium), where he outlines and implements the research strategy, coaches junior researchers in application security, and participates in dissemination, valorisation and spin-off activities. Lieven is also involved in OWASP as a board member of the Belgium OWASP Chapter, and part of the organisation team of the OWASP BeNeLux Day.<br />
<br />
===Don't trust the DOM: Bypassing XSS mitigations via script gadgets by Sebastian Lekies===<br />
====Abstract====<br />
Cross-Site Scripting is a constant problem of the Web platform. Over the years many techniques have been introduced to prevent or mitigate XSS. Most of these techniques, thereby, focus on script tags and event handlers. HTML sanitizers, for example, aim at removing potentially dangerous tags and attributes. Another example is the Content Security Policy, which forbids inline event handlers and aims at white listing of legitimate scripts.<br />
<br />
In this talk, we present a novel Web hacking technique that enables an attacker to circumvent most XSS mitigations. In order to do so, the attacker abuses so-called script gadgets. A script gadget Is a legitimate piece of JavaScript in a page that reads elements from the DOM via selectors and processes them in a way that results in script execution. To abuse a script gadget, the attacker injects a benign looking element into the page that matches the gadget's selector. Subsequently, the gadget selects the benign-looking element and executes attacker-controlled scripts. As the initially injected element is benign it passes HTML sanitizers and security policies. The XSS only surfaces when the gadget mistakenly elevates the privileges of the element.<br />
<br />
In this talk, we will demonstrate that these gadgets are present in almost all modern JavaScript libraries, APIs and applications. We will present several case studies and real-world examples that demonstrate that many mitigation techniques are not suited for modern applications. As a result, we argue that the Web should start focusing more on preventive mechanisms instead of mitigations.<br />
====Bio====<br />
Sebastian Lekies is tech leading the Web application security scanning team at Google. Before joining Google, he was part of SAP's Security Research team, where he conducted academic research in the area of client-side Web application security. Sebastian is regularly speaking at academic and non-academic security conferences such as BlackHat US/EU/Asia, DeepSec, OWASP AppSec EU, Usenix Security, CCS, and many more...<br />
<br />
<br />
===A Series of Unfortunate Events: Where Malware Meets Murphy by Mattijs van Ommeren===<br />
====Abstract====<br />
When an end user reports some “strange looking file names”, which, after investigating, you discover include several hundreds of Gigabytes of encrypted data, you of course know you are going to have a bad day. Your AV solution has failed you, your firewall has failed you, and your SIEM has failed you. Basically, every piece of security infrastructure you have put your trust (and money) into has left you out in the cold and you thank <deity of choice> that at least the nightly backup was completed successfully. Spin up the tape drive, and soon you will be back in business, or not…?<br />
<br />
This talk is about failure. Not only about a failing security infrastructure, but also about failure in doing the Right Thing™ as a first responder, about the failure of Operating System tools, failing APIs, and ironically, also the failure of malware (which is unfortunately not as positive as it may sound). The scenario presented comes pretty close to the worst chain of events you can imagine, in an attempt to recover from a ransomware incident.<br />
<br />
Luckily – this story has a happy ending. We will reveal how one can be prepared for when both Count Olaf and Murphy come knocking on your door simultaneously.<br />
====Bio====<br />
Mattijs van Ommeren has been poking hardware and software for 15 years. He has spent most of his working life as a security consultant, attacking and defending both traditional IT environments as well as more esoteric embedded devices and industrial systems. Presently he has a lot of fun at Nixu.<br />
<br />
<br />
===Common REST API security pitfalls by Philippe De Ryck===<br />
====Abstract====<br />
The shift towards a REST API landscape indicates a significant evolution in the way we build applications. The rise of JavaScript and mobile applications have sparked an explosion of easily-accessible REST APIs. But how do you protect access to your API? Which security aspects are no longer relevant? Which security features are an absolutely must-have, and which additional security measures do you need to take into account?<br />
<br />
These are hard questions, as evidenced by the deployment of numerous insecure REST APIs. Attend this session to find out about common API security pitfalls, that often result in compromised user accounts and unauthorized access to your data. We expose the problem that lies at the root of each of these pitfalls, and offer actionable advice to address these security problems. After this session, you will know how to assess the security of your APIs, and the best practices to improve them towards the future.<br />
====Bio====<br />
Philippe De Ryck is a professional speaker and trainer on software security and web security. Since he obtained his PhD at the imec-DistriNet research group (KU Leuven, Belgium), he has been running the group's Web Security Training program, which ensures a sustainable knowledge transfer of the group’s security expertise towards practitioners.<br />
<br />
<br />
===Creating An AppSec Pipeline With Containers In A Week How We Failed And Succeeded by Jeroen Willemsen===<br />
====Abstract====<br />
Join us on our adventure of setting up a appsec pipeline with Docker containers. What did go wrong, how did we succeed? How do you fight false positives and how do you get the best out of the products out there without bothering the development teams too much.<br />
====Bio====<br />
Jeroen Willemsen is a security architect with a passion for mobile and risk management. He loves to work on secure building blocks, security automation pipelines and embedding information security risk management controls in an agile environment. He is dedicated to help developers, product owners and architects to take security seriously in their daily development life (but not too serious of course ;-)).In his spare time he loves to experiment with new technologies and frameworks.”<br />
<br />
<br />
<!-- Sixth tab --><br />
<br />
= Social Event (TBD)=<br />
<br />
== Social Event,starting at 7PM ==<br />
Thursday, November 23rd<br />
;Dudok Tilburg<br />
:Veemarktstraat 33<br />
:5038 CT Tilburg<br />
:http://www.dudok.nl/<br />
Menu:<br />
:As we are a big group, Dudok will prepare the following [[Media:Dudok menu OWASP.pdf|menu]] for us!<br />
'''If you want to join the social event, don't forget to register for the social event via the registration:'''<br />
:[[image:Register_now_red.png|link=https://owasp-benelux-day-2017.eventbrite.com |200px|alt=Register for the OWASP BeNeLux Day 2017 | Register for the OWASP BeNeLux Day 2017 ]]<br />
<br />
<br />
(limited) open tap sponsored by :<br />
[[File:Avi Logo Transparent Background 300pix.png|200px|link=https://avinetworks.com/]] <br />
<br />
<!-- Seventh tab --><br />
<br />
= Sponsor =<br />
<br />
=== Become a sponsor of OWASP BeNeLux ===<br />
<br />
There are 3 combined sponsorship packages (Gold, Silver or Bronze) that cover the BeNeLux chapter meetings 2019 and the BeNeLux OWASP Days 2018.<br />
<br />
Download our sponsor brochure TBD and contact [mailto:seba@owasp.org us] for questions or sponsorship confirmation!<br />
<br />
Your sponsorship will be invested directly in the chapter meetings, supporting speaker and catering expenses. <br />
<br />
The sponsorship will also be dedicated to cover the costs of the OWASP 2018 BeNeLux event.<br />
<br />
<!-- Don't remove these two lines! -->__NOTOC__ <br />
<headertabs></headertabs><br />
<br />
<br />
<br />
=== Made possible by our {{#switchtablink:Sponsor|Sponsors}}===<br />
'''Hosted by'''<br />
<br />
<br />
'''Platinum:'''<br />
<br />
<br />
'''Gold:'''<br />
<br />
<br />
'''Silver:'''<br />
<br />
<br />
'''Bronze:'''<br />
<br />
<br />
[[Category:OWASP_AppSec_Conference]] <br />
[[Category:OWASP_BeNeLux_Archives]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=Belgium_Events_2018&diff=242932Belgium Events 20182018-08-29T14:55:18Z<p>Sdeleersnyder: </p>
<hr />
<div><noinclude><br />
These are the 2018 events of the [[Belgium|OWASP Belgium Chapter]].<br />
<br />
Previous year: [[Belgium Events 2017|2017]].<br />
</noinclude><br />
== 17 September 2018 Meeting ==<br />
<br />
=== WHEN ===<br />
Monday 17 September 2018<br />
<br />
=== WHERE ===<br />
<br />
; Host: European Commission<br />
: Place Madou, 1<br />
:1210 - Saint-Josse-Ten-Noode<br />
<pre style="color: red"><br />
Pre-registration of the participants' ID is needed to enter the venue; see registration link below!!!<br />
</pre><br />
<br />
=== PROGRAM ===<br />
The agenda:<br />
*18h15 - 19h00: '''Welcome & sandwiches'''<br> <br />
*19h00 - 19h10: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP) <br> <br />
*19h10 - 20h00: '''Docker Threat Modeling and Top 10''' (by Dirk Wetter)<br><br />
:''Abstract:'' Docker containers offer several advantages for developers. Most notably they fit perfectly in software development processes, they enable fast, reproducible<br />
deployments and when properly done, with little change the same container can<br />
run either in a test or production environment.<br />
<br />
Despite threatening information out there Docker offers per se also several<br />
security advantages. However it is important to make use of them and as a<br />
minimum avoid several pitfalls. In a worst case scenario this can lead<br />
otherwise to less security or the security benefits which the containment<br />
technology offers are not being used at all.<br />
<br />
To avoid this a proper fundamental approach is needed.<br />
<br />
Thus this talk models first the most important threats to containerized<br />
environments out there. Based on that the speaker will present 10 security<br />
bullet points which covers<br />
<br />
* important Do's and Dont's,<br />
* for advanced needs how to tighten security further.<br />
<br />
At the end the speaker gives advice how to check your Docker and<br />
Kubernetes security status yourself.<br />
<br />
The talk is based on practical experiences at several costumers and on the<br />
speaker's solid network and systems security expertise.<br />
<br />
:''Bio:'' [https://twitter.com/drwetter Dirk Wetter (Ph.D.)] is an independent security consultant with more than 20 years professional experience in information security with a broad technical<br />
and information security management background.<br />
<br />
His primary focus nowadays is around web application security. He has also a<br />
solid background on network and systems security.<br />
<br />
He's also founder and maintainer of the open source project testssl.sh which<br />
checks the encryption of every SSL/TLS enabled service.<br />
<br />
*20h00 - 20h10: break <br> <br />
*20h10 - 21h00: '''Securing Containers on the High Seas''' (by Jack Mannino)<br><br />
:''Abstract:'' It can be a difficult challenge for organizations to securely migrate to containers while shifting processes and security controls. Making the move from legacy virtualization and monolithic deployments to containers requires a solid strategy. Containers offer many inherent security benefits but it’s important to build controls in beyond the containers themselves. From development through container registries and deployment to a runtime environment, it’s important to enforce security and eliminate risks as they’re introduced.<br />
<br />
This presentation will focus on scaling container security within an enterprise and building security controls into the way you build, ship, and run containerized services. We will discuss the modern container landscape including different container runtimes and isolation models. We will explore the container lifecycle from your developer’s laptop through your production environment and examine the key security problems to mitigate.<br />
<br />
:''Bio:'' [https://twitter.com/jack_mannino Jack Mannino] is the CEO of nVisium. Passionate about security and impossible to keep away from a keyboard, his expertise spans over 15 years of building, breaking, and securing software. Jack founded nVisium in 2009, and since has helped the world's largest software teams enhance security across their software portfolios. He has spoken at conferences globally on topics such as secure design, mobile application security, and cloud-native security.<br />
*21h00 - 21h30: '''Networking drink''' <br><br />
<br />
=== REGISTRATION ===<br />
<pre style="color: red"><br />
Pre-registration of the participants' ID will be needed to enter the security on site. <br />
</pre><br />
Therefore, please register via this form at the European Commission: https://ec.europa.eu/eusurvey/runner/OWASPBelgiumChapterMeetingSept17 .<br />
<br />
'''The registration deadline expires on ''Sunday, September 16th midnight''. After this time the registration and admission to the event will not be possible.'''<br />
<br />
=== Coverage ===<br />
<br />
<br />
== 19 March 2018 Meeting ==<br />
<br />
=== WHEN ===<br />
Monday 19 March 2018<br />
<br />
=== WHERE ===<br />
<br />
; Host: ING Belgium<br />
; Address<br />
: Cours St Michel 60 - 1040 Brussel<br />
<br />
=== PROGRAM ===<br />
The agenda:<br />
*18h15 - 19h00: '''Welcome & sandwiches'''<br> <br />
*19h00 - 19h10: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP) <br> <br />
*19h10 - 20h00: '''KRACKing WPA2 in Practice Using Key Reinstallation Attacks''' (by Mathy Vanhoef, imec-DistriNet-KU Leuven)<br><br />
:''Abstract:'' This talk presents the key reinstallation attack against WPA2 (KRACK attack). It abuses design or implementation flaws in cryptographic protocols to reinstall an already-in-use key. This resets the key’s associated parameters such as transmit nonces and receive replay counters. Several cryptographic Wi-Fi handshakes are affected by the attack.<br />
:All protected Wi-Fi networks use the 4-way handshake to generate a fresh session key. So far, this 14-year-old handshake has remained free from attacks. However, we show that the 4-way handshake is vulnerable to a key reinstallation attack. Here, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying handshake messages. When reinstalling the key, associated parameters such as the incremental transmit packet number (nonce) and receive packet number (replay counter) are reset to their initial value.<br />
:Talk talk also discusses the vulnerability disclosure process that was followed. Since the discovery affected numerous vendors, coordinating the disclosure was non-trivial.<br />
:''Bio:'' '''Mathy Vanhoef''' is a postdoctoral researcher at KU Leuven. He did his PhD on the security of WPA-TKIP, TLS, and RC4. His research interest is in computer security with a focus on wireless security (e.g. Wi-Fi), network protocols in general, the RC4 stream cipher (where is discovered the RC NOMORE attack), and software security (discovering and exploiting vulnerabilities). Currently his main research is about automatically discovering vulnerabilities in network protocol implementations, and proving the correctness of protocol implementations.<br />
*20h00 - 20h10: break <br> <br />
*20h10 - 21h00: '''Making the web secure by design''' (by Glenn Ten Cate, ING Belgium, and Riccardo Ten Cate, Xebia)<br><br />
:''Abstract:'' Education is the first step in the Secure Software Development Lifecycle. The free OWASP Security Knowledge Framework (SKF) is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. This talk will help you as a developer to become THE Neo of your development team. We will show how you can do security by design and introduce other quality gates into your development pipeline to ensure high end quality and security of your project.<br />
:''Bio:'' As a coder, hacker, speaker, trainer and security researcher employed at ING Belgium, '''Glenn Ten Cate''' has over 10 years experience in the field of security. One of the founders of defensive development [defdev] a security training and conference series dedicated to helping you build and maintain secure software and also speaking at multiple other security conferences in the world. His goals is to create an open-source software development life cycle with the tools and knowledge gathered over the years.<br />
:''Bio:'' As a penetration tester from the Netherlands employed at Xebia, '''Riccardo Ten Cate''' specialises in web-application security and has extensive knowledge in securing web applications in multiple coding languages. He is also a specialist in setting up Secure Software Development Life Cycles.<br />
*21h00 - 21h30: '''Networking drink''' <br><br />
<br />
=== REGISTRATION ===<br />
Please register via EventBrite: https://owasp-belgium-2018-03-19.eventbrite.com<br />
<br />
=== Coverage ===<br />
<br />
== 20 February 2018 Meeting ==<br />
<br />
=== WHEN ===<br />
Tuesday 20 February 2018<br />
<br />
=== WHERE ===<br />
<br />
; Host: [https://distrinet.cs.kuleuven.be DistriNet Research Group (KU Leuven)] (Both speakers are faculty of the [https://www.secappdev.org/ Secure Application Development] course held in Leuven from 2018-02-19 to 2018-02-23.)<br />
; Address<br />
: Department of Computer Science (foyer at ground floor)<br/>Celestijnenlaan 200 A<br/>3001 Heverlee<br />
: ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap map], [https://distrinet.cs.kuleuven.be/about/route/ directions])<br />
<br />
=== PROGRAM ===<br />
The agenda:<br />
*18h15 - 19h00: '''Welcome & sandwiches'''<br> <br />
*19h00 - 19h10: '''[https://www.owasp.org/images/7/7a/Owasp_Belgium_update_2018-02-20_v1.pdf OWASP Update]''' (by Sebastien Deleersnyder, OWASP) <br> <br />
*19h10 - 20h00: '''[https://schd.ws/hosted_files/secappdev2018/a9/Developer%20are%20not%20the%20enemy%20SecAppDev%20web.pdf Developers are not the enemy -- Usable Security for Experts]''' (by Prof. Matthew Smith, University of Bonn)<br><br />
:''Abstract:'' Usability problems are a major cause of many of today's IT-security incidents. Security systems are often too complicated, time-consuming, and error prone. For more than a decade researchers in the domain of usable security (USEC) have attempted to combat these problems by conducting interdisciplinary research focusing on the root causes of the problems and on the creation of usable security mechanisms. While major improvements have been made, to date USEC research has focused almost entirely on the non-expert end-user. However, many of the most catastrophic security incidents were not caused by end-users, but by developers or administrators. Heartbleed and Shellshock were both caused by single developers yet had global consequences. The Sony hack in 2014 compromised an entire multi-national IT-infrastructure and misappropriated over 100 TB of data, unnoticed. Fundamentally, every software vulnerability and misconfigured system is caused by developers or administrators making mistakes, but very little research has been done into the underlying causalities and possible mitigation strategies. In this talk we will explore the transition from end-user to expert usable security research and look at several application areas, including TLS, passwords, malware analysis and vulnerability analysis.<br />
:''Bio:'' '''Matthew Smith''' is a Professor for Usable Security and Privacy at the University of Bonn. His research is focused on human factors of security and privacy mechanisms with a wide range of application areas, including TLS and network security, authentication, mobile and app security and, most recently, usable security for developers and administrators. His work has been published at amongst others IEEE S&P, ACM CCS, USENIX Security, NDSS, ACM SIGCHI and SOUPS the Symposium on Usable Security and Privacy. In 2015 his ERC Starting Grant "Frontiers of Usable Security" was selected for funding. <br />
*20h00 - 20h10: '''Break'''<br> <br />
*20h10 - 21h00: '''[https://schd.ws/hosted_files/secappdev2018/75/The%20code%20behind%20the%20vulnerability.pdf The Code Behind The Vulnerability]''' (by Barry Dorrans)<br><br />
:''Abstract:'' Everyone makes security mistakes, and that includes Microsoft (seriously!). Many developers can spot and prevent vulnerabilities listed in the OWASP top 10. But that narrative changes when we look beyond the scope of the OWASP top 10. Compared to some more recent attacks, fixing XSS or SQL injection almost seems easy. In this session, we dive into a couple of .NET core cases that have been reported to the Microsoft Security Response Center (MSRC). Mind you; these vulnerabilities are not just framework vulnerabilities. Instead, they are coding patterns that you may have introduced in your applications. Examples are issues with hash tables, compression, encryption, regular expressions and more. In this session, you will learn how to spot these vulnerabilities in your code. On top of that, you will walk away with the skills to fix them.<br />
:''Bio:'' '''Barry Dorrans''' is the .NET Security Czar, which means he tries to tell everyone else how to code securely and taking the credit when it goes right, as well as running the .NET Core Bug Bounty. He also ends up triaging publicly and privately reported vulnerabilities when it goes wrong before getting someone else to fix the mistakes. This he gets all the fun and none of the real work, aside from the endless stress wondering when the next vulnerability will be discovered.<br />
<br />
=== REGISTRATION ===<br />
Please register via EventBrite: https://owasp-belgium-2018-02-20.eventbrite.com<br />
<br />
=== Coverage ===</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=Belgium_Events_2018&diff=242878Belgium Events 20182018-08-28T04:31:37Z<p>Sdeleersnyder: </p>
<hr />
<div><noinclude><br />
These are the 2018 events of the [[Belgium|OWASP Belgium Chapter]].<br />
<br />
Previous year: [[Belgium Events 2017|2017]].<br />
</noinclude><br />
== 17 September 2018 Meeting ==<br />
<br />
=== WHEN ===<br />
Monday 17 September 2018<br />
<br />
=== WHERE ===<br />
<br />
; Host: European Commission<br />
: Place Madou, 1<br />
:1210 - Saint-Josse-Ten-Noode<br />
<pre style="color: red"><br />
Pre-registration of the participants' ID is needed to enter the venue; see registration link below!!!<br />
</pre><br />
<br />
=== PROGRAM ===<br />
The agenda:<br />
*18h15 - 19h00: '''Welcome & sandwiches'''<br> <br />
*19h00 - 19h10: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP) <br> <br />
*19h10 - 20h00: '''Docker Threat Modeling and Top 10''' (by Dirk Wetter)<br><br />
:''Abstract:'' Docker containers offer several advantages for developers. Most notably they fit perfectly in software development processes, they enable fast, reproducible<br />
deployments and when properly done, with little change the same container can<br />
run either in a test or production environment.<br />
<br />
Despite threatening information out there Docker offers per se also several<br />
security advantages. However it is important to make use of them and as a<br />
minimum avoid several pitfalls. In a worst case scenario this can lead<br />
otherwise to less security or the security benefits which the containment<br />
technology offers are not being used at all.<br />
<br />
To avoid this a proper fundamental approach is needed.<br />
<br />
Thus this talk models first the most important threats to containerized<br />
environments out there. Based on that the speaker will present 10 security<br />
bullet points which covers<br />
<br />
* important Do's and Dont's,<br />
* for advanced needs how to tighten security further.<br />
<br />
At the end the speaker gives advice how to check your Docker and<br />
Kubernetes security status yourself.<br />
<br />
The talk is based on practical experiences at several costumers and on the<br />
speaker's solid network and systems security expertise.<br />
<br />
:''Bio:'' [https://twitter.com/drwetter Dirk Wetter (Ph.D.)] is an independent security consultant with more than 20 years professional experience in information security with a broad technical<br />
and information security management background.<br />
<br />
His primary focus nowadays is around web application security. He has also a<br />
solid background on network and systems security.<br />
<br />
He's also founder and maintainer of the open source project testssl.sh which<br />
checks the encryption of every SSL/TLS enabled service.<br />
<br />
*20h00 - 20h10: break <br> <br />
*20h10 - 21h00: '''TBD''' (by TBD)<br><br />
:''Abstract:'' TBD<br />
:''Bio:'' TBD<br />
*21h00 - 21h30: '''Networking drink''' <br><br />
<br />
=== REGISTRATION ===<br />
<pre style="color: red"><br />
Pre-registration of the participants' ID will be needed to enter the security on site. <br />
</pre><br />
Therefore, please register via this form at the European Commission: https://ec.europa.eu/eusurvey/runner/OWASPBelgiumChapterMeetingSept17 .<br />
<br />
'''The registration deadline expires on ''Sunday, September 16th midnight''. After this time the registration and admission to the event will not be possible.'''<br />
<br />
=== Coverage ===<br />
<br />
<br />
== 19 March 2018 Meeting ==<br />
<br />
=== WHEN ===<br />
Monday 19 March 2018<br />
<br />
=== WHERE ===<br />
<br />
; Host: ING Belgium<br />
; Address<br />
: Cours St Michel 60 - 1040 Brussel<br />
<br />
=== PROGRAM ===<br />
The agenda:<br />
*18h15 - 19h00: '''Welcome & sandwiches'''<br> <br />
*19h00 - 19h10: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP) <br> <br />
*19h10 - 20h00: '''KRACKing WPA2 in Practice Using Key Reinstallation Attacks''' (by Mathy Vanhoef, imec-DistriNet-KU Leuven)<br><br />
:''Abstract:'' This talk presents the key reinstallation attack against WPA2 (KRACK attack). It abuses design or implementation flaws in cryptographic protocols to reinstall an already-in-use key. This resets the key’s associated parameters such as transmit nonces and receive replay counters. Several cryptographic Wi-Fi handshakes are affected by the attack.<br />
:All protected Wi-Fi networks use the 4-way handshake to generate a fresh session key. So far, this 14-year-old handshake has remained free from attacks. However, we show that the 4-way handshake is vulnerable to a key reinstallation attack. Here, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying handshake messages. When reinstalling the key, associated parameters such as the incremental transmit packet number (nonce) and receive packet number (replay counter) are reset to their initial value.<br />
:Talk talk also discusses the vulnerability disclosure process that was followed. Since the discovery affected numerous vendors, coordinating the disclosure was non-trivial.<br />
:''Bio:'' '''Mathy Vanhoef''' is a postdoctoral researcher at KU Leuven. He did his PhD on the security of WPA-TKIP, TLS, and RC4. His research interest is in computer security with a focus on wireless security (e.g. Wi-Fi), network protocols in general, the RC4 stream cipher (where is discovered the RC NOMORE attack), and software security (discovering and exploiting vulnerabilities). Currently his main research is about automatically discovering vulnerabilities in network protocol implementations, and proving the correctness of protocol implementations.<br />
*20h00 - 20h10: break <br> <br />
*20h10 - 21h00: '''Making the web secure by design''' (by Glenn Ten Cate, ING Belgium, and Riccardo Ten Cate, Xebia)<br><br />
:''Abstract:'' Education is the first step in the Secure Software Development Lifecycle. The free OWASP Security Knowledge Framework (SKF) is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. This talk will help you as a developer to become THE Neo of your development team. We will show how you can do security by design and introduce other quality gates into your development pipeline to ensure high end quality and security of your project.<br />
:''Bio:'' As a coder, hacker, speaker, trainer and security researcher employed at ING Belgium, '''Glenn Ten Cate''' has over 10 years experience in the field of security. One of the founders of defensive development [defdev] a security training and conference series dedicated to helping you build and maintain secure software and also speaking at multiple other security conferences in the world. His goals is to create an open-source software development life cycle with the tools and knowledge gathered over the years.<br />
:''Bio:'' As a penetration tester from the Netherlands employed at Xebia, '''Riccardo Ten Cate''' specialises in web-application security and has extensive knowledge in securing web applications in multiple coding languages. He is also a specialist in setting up Secure Software Development Life Cycles.<br />
*21h00 - 21h30: '''Networking drink''' <br><br />
<br />
=== REGISTRATION ===<br />
Please register via EventBrite: https://owasp-belgium-2018-03-19.eventbrite.com<br />
<br />
=== Coverage ===<br />
<br />
== 20 February 2018 Meeting ==<br />
<br />
=== WHEN ===<br />
Tuesday 20 February 2018<br />
<br />
=== WHERE ===<br />
<br />
; Host: [https://distrinet.cs.kuleuven.be DistriNet Research Group (KU Leuven)] (Both speakers are faculty of the [https://www.secappdev.org/ Secure Application Development] course held in Leuven from 2018-02-19 to 2018-02-23.)<br />
; Address<br />
: Department of Computer Science (foyer at ground floor)<br/>Celestijnenlaan 200 A<br/>3001 Heverlee<br />
: ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap map], [https://distrinet.cs.kuleuven.be/about/route/ directions])<br />
<br />
=== PROGRAM ===<br />
The agenda:<br />
*18h15 - 19h00: '''Welcome & sandwiches'''<br> <br />
*19h00 - 19h10: '''[https://www.owasp.org/images/7/7a/Owasp_Belgium_update_2018-02-20_v1.pdf OWASP Update]''' (by Sebastien Deleersnyder, OWASP) <br> <br />
*19h10 - 20h00: '''[https://schd.ws/hosted_files/secappdev2018/a9/Developer%20are%20not%20the%20enemy%20SecAppDev%20web.pdf Developers are not the enemy -- Usable Security for Experts]''' (by Prof. Matthew Smith, University of Bonn)<br><br />
:''Abstract:'' Usability problems are a major cause of many of today's IT-security incidents. Security systems are often too complicated, time-consuming, and error prone. For more than a decade researchers in the domain of usable security (USEC) have attempted to combat these problems by conducting interdisciplinary research focusing on the root causes of the problems and on the creation of usable security mechanisms. While major improvements have been made, to date USEC research has focused almost entirely on the non-expert end-user. However, many of the most catastrophic security incidents were not caused by end-users, but by developers or administrators. Heartbleed and Shellshock were both caused by single developers yet had global consequences. The Sony hack in 2014 compromised an entire multi-national IT-infrastructure and misappropriated over 100 TB of data, unnoticed. Fundamentally, every software vulnerability and misconfigured system is caused by developers or administrators making mistakes, but very little research has been done into the underlying causalities and possible mitigation strategies. In this talk we will explore the transition from end-user to expert usable security research and look at several application areas, including TLS, passwords, malware analysis and vulnerability analysis.<br />
:''Bio:'' '''Matthew Smith''' is a Professor for Usable Security and Privacy at the University of Bonn. His research is focused on human factors of security and privacy mechanisms with a wide range of application areas, including TLS and network security, authentication, mobile and app security and, most recently, usable security for developers and administrators. His work has been published at amongst others IEEE S&P, ACM CCS, USENIX Security, NDSS, ACM SIGCHI and SOUPS the Symposium on Usable Security and Privacy. In 2015 his ERC Starting Grant "Frontiers of Usable Security" was selected for funding. <br />
*20h00 - 20h10: '''Break'''<br> <br />
*20h10 - 21h00: '''[https://schd.ws/hosted_files/secappdev2018/75/The%20code%20behind%20the%20vulnerability.pdf The Code Behind The Vulnerability]''' (by Barry Dorrans)<br><br />
:''Abstract:'' Everyone makes security mistakes, and that includes Microsoft (seriously!). Many developers can spot and prevent vulnerabilities listed in the OWASP top 10. But that narrative changes when we look beyond the scope of the OWASP top 10. Compared to some more recent attacks, fixing XSS or SQL injection almost seems easy. In this session, we dive into a couple of .NET core cases that have been reported to the Microsoft Security Response Center (MSRC). Mind you; these vulnerabilities are not just framework vulnerabilities. Instead, they are coding patterns that you may have introduced in your applications. Examples are issues with hash tables, compression, encryption, regular expressions and more. In this session, you will learn how to spot these vulnerabilities in your code. On top of that, you will walk away with the skills to fix them.<br />
:''Bio:'' '''Barry Dorrans''' is the .NET Security Czar, which means he tries to tell everyone else how to code securely and taking the credit when it goes right, as well as running the .NET Core Bug Bounty. He also ends up triaging publicly and privately reported vulnerabilities when it goes wrong before getting someone else to fix the mistakes. This he gets all the fun and none of the real work, aside from the endless stress wondering when the next vulnerability will be discovered.<br />
<br />
=== REGISTRATION ===<br />
Please register via EventBrite: https://owasp-belgium-2018-02-20.eventbrite.com<br />
<br />
=== Coverage ===</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&diff=241198OWASP SAMM Project2018-06-07T13:29:59Z<p>Sdeleersnyder: </p>
<hr />
<div>= Main = <br />
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''OWASP SAMM v1.5 available in the downloads section!'''<br />
<br />
'''Join our monthly calls'''<br />
* The monthly call is on each 2nd Wednesday of the month at 21h30 CEST / 3:30pm EST. <br><br />
* Please join our GoToMeeting: https://global.gotomeeting.com/join/262891661 <br><br />
* The call is open for everybody interested in SAMM or who wants to work on SAMM. <br><br />
<br />
'''2018 OWASP SAMM Summit (4-8 JUNE 2018, London)'''<br />
* Join our 2018 OWASP SAMM Summit near London as part of the [https://open-security-summit.org/ Open Security Summit].<br><br />
* We will organize working sessions in a 5-day sprint to draft SAMM v2.0. <br />
* Register online [https://open-security-summit.org/tickets/ here]<br />
* Sponsor the SAMM2, more details [https://www.owasp.org/index.php/OWASP_SAMM_Project#tab=Project_Sponsors here]<br />
<br />
<br />
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:<br />
* '''Evaluate an organization’s existing software security practices'''<br />
* '''Build a balanced software security assurance program in well-defined iterations'''<br />
* '''Demonstrate concrete improvements to a security assurance program'''<br />
* '''Define and measure security-related activities throughout an organization'''<br />
<br />
<br />
<br />
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'', ('''Michael J. Craigue, Information Security & Compliance, Dell, Inc.''')<br />
<br />
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]<br />
<br />
{{Social Media Links}}<br />
<br />
| valign="top" style="padding-left:25px;width:200px;" |<br />
<br />
== Quick Download v1.5 ==<br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick Start Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Toolbox Example] <br><br />
[https://github.com/OWASP/samm/ OWASP SAMM on GitHub]<br />
<br />
== Quick Download v1.1.1 ==<br />
<br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]<br><br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box]<br><br />
[https://github.com/OWASP/samm OWASP SAMM on GitHub]<br />
<br />
== News and Events ==<br />
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs<br />
<br />
== Change Log ==<br />
* OWASP SAMM v1.5 Released! ([http://www.prnewswire.com/news-releases/owasp-samm-v15-helps-organizations-improve-their-security-posture-300439237.html Press Release])<br />
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
== Email List ==<br />
<br />
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]<br />
<br />
== Project Leaders ==<br />
<br />
[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] <br /> [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win]<br />
<br />
== Related Projects ==<br />
<br />
*<br />
<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]<br />
| align="center" valign="center" width="50%" | [[File:Owasp-defenders-small.png|link=]]<br />
|<br />
|-<br />
| align="center" valign="center" width="50%" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= Browse Online =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.<br />
<br />
[[Image:SAMM-Overview.png|720px]]<br />
<br />
===== Click on any badge to learn more =====<br />
<br />
{| cellpadding="1"<br />
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]<br />
|-<br />
| align="center" |'''Strategy & Metrics'''<br />
|{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM|padding=0}}<br />
|-<br />
| align="center" |'''Policy & Compliance'''<br />
|{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC|padding=0}}<br />
|-<br />
| align="center" |'''Education & Guidance'''<br />
|{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]<br />
|-<br />
| align="center" |'''Threat Assessment'''<br />
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}<br />
|-<br />
| align="center" |'''Security Requirements'''<br />
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}<br />
|-<br />
| align="center" |'''Secure Architecture'''<br />
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]<br />
|-<br />
| align="center" |'''Design Review'''<br />
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}<br />
|-<br />
| align="center" |'''Code Review'''<br />
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}<br />
|-<br />
| align="center" |'''Security Testing'''<br />
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]<br />
|-<br />
| align="center" |'''Vulnerability Management'''<br />
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}<br />
|-<br />
| align="center" |'''Environment Hardening'''<br />
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}<br />
|-<br />
| align="center" |'''Operational Enablement'''<br />
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}<br />
|-<br />
|}<br />
<br />
= Downloads =<br />
<br />
The latest work in progress can be found on Github: https://github.com/OWASP/samm<br />
<br />
Download SAMM v1.5<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] Zip file containing all the v1.5 files below;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] to perform SAMM assessments and create SAMM roadmaps;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Tool Box Example] to provide an example SAMM assessment;<br />
<br />
Download SAMM v1.1<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;<br />
<br />
Download OpenSAMM v1.0:<br />
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML<br />
* in [https://www.owasp.org/images/f/fd/SAMM-1.0-cn.pdf Chinese - PDF], not available as XML<br />
<br />
<br />
Available resources to apply SAMM:<br />
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]<br />
<br />
<br />
Trainings:<br />
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge<br />
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]<br />
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]<br />
<br />
<br />
Assessments:<br />
* SAMM v1.5 Toolbox<br />
** Download the new v1.5 Toolbox with the updated scoring model [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM v1.5 Toolbox]<br />
* SAMM v1.1 Toolbox<br />
** download the v1.1 toolbox, including the updated questions [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx here]<br />
* Assessment Interview Template by Nick Coblentz for SAMM V1.0<br />
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.<br />
* Roadmap Chart Template by Colin Watson for SAMM V1.0<br />
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.<br />
* Assessment Worksheet by Christian Frichot for SAMM V1.0<br />
** This is an easy-to-use [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.<br />
* Project Plan Template by Jim Weiler for SAMM V1.0<br />
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.<br />
<br />
<br />
Mappings:<br />
* BSIMM-6 mapping to SAMM activities:<br />
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]<br />
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]<br />
* BSIMM mapping to SAMM during the 2011 Summit:<br />
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).<br />
<br />
<br />
Tools:<br />
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]<br />
<br />
= Community =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}<br />
<br />
</div><br />
<br />
= Summit =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 >here<] !!<br />
<br />
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit<br />
<br />
<br />
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 >here<] !!<br />
<br />
Summit Notes:<br />
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit<br />
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]<br />
''"The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers."'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company<br />
<br />
Previous workshop Notes:<br />
<br />
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.<br />
<br />
This is also an excellent opportunity to exchange experiences with your peers.<br />
<br />
If you plan on attending http://appsec.eu be sure to get involved in the SAMM workshop (scheduled on Jun-23).<br />
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].<br />
<br />
Previous workshop notes:<br />
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].<br />
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].<br />
<br />
<br />
= Talks =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
Upcoming talks featuring SAMM are listed here:<br />
<br />
* OWASP DC - Software Assurance Maturity Model (SAMM) with Brian Glas! (2017-03-15)<br />
* OWASP NoVA - SAMM 1.5, what's changed and how it impacts you (2017-03-16)<br />
* InfoSec World - Software Assurance Maturity Model Evolutions (2017-04-03)<br />
<br />
past talks:<br />
<br />
* OWASP SAMM v1.5 Webinar - Brian Glas discussing the SAMM model and changes in v1.5 (watch - [https://www.youtube.com/watch?v=4pKdwRb8fTI youtube]) - 2017<br />
* OWASP 24/7 - Seba Deleersnyder discussing the upcoming SAMM Summit (listen - [https://soundcloud.com/owasp-podcast/seba-deleersnyder-discusses-samm-software-assurance-maturity-model-summit-in-dublin-ireland here]) - 2015<br />
* OWASP Germany Day 2014: Seba Deleersnyder: OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/f/fa/OpenSAMM_Best_Practices_Lessons_from_the_Trenches_-_Seba_Deleersnyder.pdf presentation]) - 2014<br />
* AppSecEU14: Seba Deleersnyder & Bart De Win: OpenSAMM Best Practices: Lessons from the Trenches OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/6/6f/OpenSAMM_-_AppSecEU_2014_-_Seba-Bart_v20140528.pptx presentation], see [https://www.youtube.com/watch?v=qcCgeBeBLUg video]) - 2014<br />
* AppSecEU13 - Hamburg: Seba Deleersnyder presenting a project update (download [https://www.owasp.org/images/3/32/OpenSAMM_-_Project_Status_-_Hamburg_2013.pdf presentation]) - 2013<br />
* OWASP Europe Tour 2013 - Geneva: Seba Deleersnyder presenting OpenSAMM and the renewed project (download [https://www.owasp.org/images/c/cd/OpenSAMM_-_OWASP_Tour_13_Talk_-_Seba.pptx presentation]) - 2013<br />
* AppSecEU11 - Athens: Colin Watson presenting SAMM Training (download [https://www.owasp.org/images/1/18/Owasp-training-samm-greece.pdf presentation]) - 2011<br />
* AppSecEU09: Pravir Chandra presenting OpenSAMM v1.0 (download [https://www.owasp.org/images/4/49/AppSecEU09_OpenSAMM-1.0.ppt presentation]) - 2009<br />
* Matt Bartoldus presentation on new SAMM project during OWASP London chapter (download [https://www.owasp.org/images/d/df/OpenSAMM.pdf presentation]) - 2009<br />
* Pravir Chandra - first presentation discussing the next generation to the CLASP Project- a complete working of the details into a Software Assurance Maturity Model (SAMM). (download [https://www.owasp.org/images/2/2e/OWASP_CLASP_SAMM.ppt presentation]) - 2009<br />
<br />
</div><br />
<br />
= News =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Latest News on SAMM<br />
* OWASP SAMM v2.0 workshop at the OWASP Project Summit June 2017<br />
* OWASP SAMM v1.5 Released!<br />
* SAMM Summit 2016 read the [https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit wrap-up here] <br />
* OWASP SAMM v1.1 Released! See the [http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release].<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
</div><br />
<br />
= Languages =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''SAMM v1.0 is available in the following languages:'''<br />
<br />
* English<br />
* Spanish<br />
* Japanese<br />
* Chinese<br />
<br />
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].<br />
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!<br />
<br />
</div><br />
<br />
= Roadmap =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Updated roadmap:<br />
Next 1.5 release, updated scoring:<br />
* Clarification of maturity levels (syntactic changes to keep the text consistent)<br />
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. <br />
* Show improvements with every activity introduced<br />
* Adapt for the new scoring method<br />
* Update questions for 4-tiers<br />
* Review and where necessary clarify current questions<br />
* Consider v1.1 remarks that were not withheld for the previous release<br />
Targeted completion date: February 28, 2017<br />
<br />
SAMM version 2.0<br />
* Core model changed<br />
* Visualisations + flavours for a few development methodologies<br />
* Update quickstart guide, TB, HTG. <br />
* Success metrics: How well does the model work: Linked to the benchmarking project.<br />
Timing: Workshops as part of OWASP Project Summit June 2017<br />
<br />
</div><br />
= Get Involved =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Involvement in the development of SAMM is actively encouraged!<br />
<br />
You do not have to be a security expert in order to contribute.<br />
<br />
Some of the ways you can help:<br />
<br />
==Feedback==<br />
<br />
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:<br />
* What do like?<br />
* What don't you like?<br />
* How can we make SAMM easier to use?<br />
* How could SAMM be improved? <br />
<br />
<br />
==Localization==<br />
<br />
Are you fluent in another language? Can you help translate SAMM into that language?<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!<br />
<br />
</div><br />
<br />
= Project Sponsors =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
SAMM is developed and maintained by a worldwide team of volunteers. We have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM.<br />
<br />
==SAMM Adopters==<br />
SAMM is the premier open source software assurance framework. You can find a list of [https://www.owasp.org/index.php/OpenSAMM_Adopters SAMM adopters] online.<br />
<br />
==Call for SAMM2 Sponsors==<br />
OWASP SAMM and the upcoming SAMM 2.0 release is the open source software security maturity model used to develop secure software for IT, application and software security technologists. <br />
<br />
We are seeking sponsors to support OWASP SAMM. All proceeds from the sponsorship support the mission of the OWASP Foundation and the further development of SAMM. Supporting the project drives the funding for research grants, SAMM hosting, tools, templates, documents, promotion, and more.<br />
<br />
By sponsoring SAMM, you not only support an important and flagship OWASP project, you will also get visibility during the next SAMM Summit (part of the OWASP Summit 2018) and recognition on the OWASP SAMM project web site and the next release of SAMM (version 2.0).<br />
<br />
For more information: Download our [https://www.owasp.org/images/f/fb/OWASP_SAMM2_Sponsorship_Form_v20170212.pdf SAMM2 sponsorship brochure].<br />
<br />
Contact [mailto:seba@owasp.org seba@owasp.org] to activate your sponsorship.<br />
<br />
==== Acknowledgements ====<br />
<br />
<br />
<br />
We would like to thank the following sponsors who donated funds to our project:<br />
<br />
[[File:OWASP-NoVA-Chapter-Logo.PNG|250px|link=https://www.owasp.org/index.php/Virginia]]<br />
[[File:Belgium_Chapter.PNG|250px|link=https://www.owasp.org/index.php/Belgium]]<br />
[[File:London_Chapter.PNG|250px|link=https://www.owasp.org/index.php/London]]<br />
<br />
[[File:Aspectsecurity.png|250px|link=http://www.aspectsecurity.com]]<br />
[[File:Astech_Consulting_logo.png|250px|link=http://www.astechconsulting.com/]] <br />
[[File:Denim_Group_logo.jpg|250px|link=http://www.denimgroup.com/]] <br />
[[File:Gotham_Digital_Science_logo.jpg|250px|link=http://www.gdssecurity.com/]] <br />
<br />
{{MemberLinksv2|link=http://www.hpenterprisesecurity.com|logo=HP_Blue_RGB_150_SM.png|size=300px90px}} <br />
[[File:NetSPI_logo.png|250px|link=http://www.netspi.com/]] <br />
[[Image:PwC_logo_4colourprint_(2)_Resized_good_one.jpg|150px|link=http://www.pwc.com]]<br />
[[File:SI_Logo_Stacked_Application_Security.jpg|250px|link=http://www.securityinnovation.com/]] <br />
[[File:LogoToreon.jpg|250px|link=http://www.toreon.com]] <br />
[[File:Veracode-samm.png|250px|link=http://www.veracode.com]] <br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
<br /><br />
{{OWASP Book|6888083}}<br />
<br /><br />
<br />
[[Category:OWASP Project|Zed Attack Proxy Project]]<br />
[[Category:OWASP_Tool]]<br />
[[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]]<br />
[[Category:OWASP_Download]]<br />
[[Category:Popular]]</div>Sdeleersnyderhttps://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&diff=241197OWASP SAMM Project2018-06-07T13:29:19Z<p>Sdeleersnyder: </p>
<hr />
<div>= Main = <br />
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''OWASP SAMM v1.5 available in the downloads section!'''<br />
<br />
'''Join our monthly calls"""<br />
The monthly call is on each 2nd Wednesday of the month at 21h30 CEST / 3:30pm EST. <br><br />
Please join our GoToMeeting: https://global.gotomeeting.com/join/262891661 <br><br />
The call is open for everybody interested in SAMM or who wants to work on SAMM. <br><br />
<br />
'''2018 OWASP SAMM Summit (4-8 JUNE 2018, London)'''<br />
* Join our 2018 OWASP SAMM Summit near London as part of the [https://open-security-summit.org/ Open Security Summit].<br><br />
* We will organize working sessions in a 5-day sprint to draft SAMM v2.0. <br />
* Register online [https://open-security-summit.org/tickets/ here]<br />
* Sponsor the SAMM2, more details [https://www.owasp.org/index.php/OWASP_SAMM_Project#tab=Project_Sponsors here]<br />
<br />
<br />
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:<br />
* '''Evaluate an organization’s existing software security practices'''<br />
* '''Build a balanced software security assurance program in well-defined iterations'''<br />
* '''Demonstrate concrete improvements to a security assurance program'''<br />
* '''Define and measure security-related activities throughout an organization'''<br />
<br />
<br />
<br />
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'', ('''Michael J. Craigue, Information Security & Compliance, Dell, Inc.''')<br />
<br />
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]<br />
<br />
{{Social Media Links}}<br />
<br />
| valign="top" style="padding-left:25px;width:200px;" |<br />
<br />
== Quick Download v1.5 ==<br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick Start Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Toolbox Example] <br><br />
[https://github.com/OWASP/samm/ OWASP SAMM on GitHub]<br />
<br />
== Quick Download v1.1.1 ==<br />
<br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]<br><br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] <br><br />
[https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box]<br><br />
[https://github.com/OWASP/samm OWASP SAMM on GitHub]<br />
<br />
== News and Events ==<br />
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs<br />
<br />
== Change Log ==<br />
* OWASP SAMM v1.5 Released! ([http://www.prnewswire.com/news-releases/owasp-samm-v15-helps-organizations-improve-their-security-posture-300439237.html Press Release])<br />
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
== Email List ==<br />
<br />
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]<br />
<br />
== Project Leaders ==<br />
<br />
[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] <br /> [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win]<br />
<br />
== Related Projects ==<br />
<br />
*<br />
<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]<br />
| align="center" valign="center" width="50%" | [[File:Owasp-defenders-small.png|link=]]<br />
|<br />
|-<br />
| align="center" valign="center" width="50%" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= Browse Online =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.<br />
<br />
[[Image:SAMM-Overview.png|720px]]<br />
<br />
===== Click on any badge to learn more =====<br />
<br />
{| cellpadding="1"<br />
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]<br />
|-<br />
| align="center" |'''Strategy & Metrics'''<br />
|{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM|padding=0}}<br />
|-<br />
| align="center" |'''Policy & Compliance'''<br />
|{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC|padding=0}}<br />
|-<br />
| align="center" |'''Education & Guidance'''<br />
|{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]<br />
|-<br />
| align="center" |'''Threat Assessment'''<br />
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}<br />
|-<br />
| align="center" |'''Security Requirements'''<br />
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}<br />
|-<br />
| align="center" |'''Secure Architecture'''<br />
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]<br />
|-<br />
| align="center" |'''Design Review'''<br />
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}<br />
|-<br />
| align="center" |'''Code Review'''<br />
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}<br />
|-<br />
| align="center" |'''Security Testing'''<br />
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}<br />
|-<br />
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]<br />
|-<br />
| align="center" |'''Vulnerability Management'''<br />
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}<br />
|-<br />
| align="center" |'''Environment Hardening'''<br />
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}<br />
|-<br />
| align="center" |'''Operational Enablement'''<br />
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}<br />
|-<br />
|}<br />
<br />
= Downloads =<br />
<br />
The latest work in progress can be found on Github: https://github.com/OWASP/samm<br />
<br />
Download SAMM v1.5<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/OWASP_SAMM_v1.5.zip All SAMM v1.5 files (.zip)] Zip file containing all the v1.5 files below;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM Toolbox] to perform SAMM assessments and create SAMM roadmaps;<br />
* [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx SAMM Tool Box Example] to provide an example SAMM assessment;<br />
<br />
Download SAMM v1.1<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;<br />
* [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;<br />
<br />
Download OpenSAMM v1.0:<br />
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]<br />
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML<br />
* in [https://www.owasp.org/images/f/fd/SAMM-1.0-cn.pdf Chinese - PDF], not available as XML<br />
<br />
<br />
Available resources to apply SAMM:<br />
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]<br />
<br />
<br />
Trainings:<br />
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge<br />
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]<br />
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]<br />
<br />
<br />
Assessments:<br />
* SAMM v1.5 Toolbox<br />
** Download the new v1.5 Toolbox with the updated scoring model [https://github.com/OWASP/samm/blob/master/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx SAMM v1.5 Toolbox]<br />
* SAMM v1.1 Toolbox<br />
** download the v1.1 toolbox, including the updated questions [https://github.com/OWASP/samm/blob/master/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx here]<br />
* Assessment Interview Template by Nick Coblentz for SAMM V1.0<br />
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.<br />
* Roadmap Chart Template by Colin Watson for SAMM V1.0<br />
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.<br />
* Assessment Worksheet by Christian Frichot for SAMM V1.0<br />
** This is an easy-to-use [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.<br />
* Project Plan Template by Jim Weiler for SAMM V1.0<br />
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.<br />
<br />
<br />
Mappings:<br />
* BSIMM-6 mapping to SAMM activities:<br />
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]<br />
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]<br />
* BSIMM mapping to SAMM during the 2011 Summit:<br />
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).<br />
<br />
<br />
Tools:<br />
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]<br />
<br />
= Community =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}<br />
<br />
</div><br />
<br />
= Summit =<br />
<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 >here<] !!<br />
<br />
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit<br />
<br />
<br />
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 >here<] !!<br />
<br />
Summit Notes:<br />
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit<br />
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]<br />
''"The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers."'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company<br />
<br />
Previous workshop Notes:<br />
<br />
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.<br />
<br />
This is also an excellent opportunity to exchange experiences with your peers.<br />
<br />
If you plan on attending http://appsec.eu be sure to get involved in the SAMM workshop (scheduled on Jun-23).<br />
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].<br />
<br />
Previous workshop notes:<br />
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].<br />
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].<br />
<br />
<br />
= Talks =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
Upcoming talks featuring SAMM are listed here:<br />
<br />
* OWASP DC - Software Assurance Maturity Model (SAMM) with Brian Glas! (2017-03-15)<br />
* OWASP NoVA - SAMM 1.5, what's changed and how it impacts you (2017-03-16)<br />
* InfoSec World - Software Assurance Maturity Model Evolutions (2017-04-03)<br />
<br />
past talks:<br />
<br />
* OWASP SAMM v1.5 Webinar - Brian Glas discussing the SAMM model and changes in v1.5 (watch - [https://www.youtube.com/watch?v=4pKdwRb8fTI youtube]) - 2017<br />
* OWASP 24/7 - Seba Deleersnyder discussing the upcoming SAMM Summit (listen - [https://soundcloud.com/owasp-podcast/seba-deleersnyder-discusses-samm-software-assurance-maturity-model-summit-in-dublin-ireland here]) - 2015<br />
* OWASP Germany Day 2014: Seba Deleersnyder: OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/f/fa/OpenSAMM_Best_Practices_Lessons_from_the_Trenches_-_Seba_Deleersnyder.pdf presentation]) - 2014<br />
* AppSecEU14: Seba Deleersnyder & Bart De Win: OpenSAMM Best Practices: Lessons from the Trenches OpenSAMM Best Practices: Lessons from the Trenches (download [https://www.owasp.org/images/6/6f/OpenSAMM_-_AppSecEU_2014_-_Seba-Bart_v20140528.pptx presentation], see [https://www.youtube.com/watch?v=qcCgeBeBLUg video]) - 2014<br />
* AppSecEU13 - Hamburg: Seba Deleersnyder presenting a project update (download [https://www.owasp.org/images/3/32/OpenSAMM_-_Project_Status_-_Hamburg_2013.pdf presentation]) - 2013<br />
* OWASP Europe Tour 2013 - Geneva: Seba Deleersnyder presenting OpenSAMM and the renewed project (download [https://www.owasp.org/images/c/cd/OpenSAMM_-_OWASP_Tour_13_Talk_-_Seba.pptx presentation]) - 2013<br />
* AppSecEU11 - Athens: Colin Watson presenting SAMM Training (download [https://www.owasp.org/images/1/18/Owasp-training-samm-greece.pdf presentation]) - 2011<br />
* AppSecEU09: Pravir Chandra presenting OpenSAMM v1.0 (download [https://www.owasp.org/images/4/49/AppSecEU09_OpenSAMM-1.0.ppt presentation]) - 2009<br />
* Matt Bartoldus presentation on new SAMM project during OWASP London chapter (download [https://www.owasp.org/images/d/df/OpenSAMM.pdf presentation]) - 2009<br />
* Pravir Chandra - first presentation discussing the next generation to the CLASP Project- a complete working of the details into a Software Assurance Maturity Model (SAMM). (download [https://www.owasp.org/images/2/2e/OWASP_CLASP_SAMM.ppt presentation]) - 2009<br />
<br />
</div><br />
<br />
= News =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Latest News on SAMM<br />
* OWASP SAMM v2.0 workshop at the OWASP Project Summit June 2017<br />
* OWASP SAMM v1.5 Released!<br />
* SAMM Summit 2016 read the [https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit wrap-up here] <br />
* OWASP SAMM v1.1 Released! See the [http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release].<br />
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]<br />
<br />
</div><br />
<br />
= Languages =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
'''SAMM v1.0 is available in the following languages:'''<br />
<br />
* English<br />
* Spanish<br />
* Japanese<br />
* Chinese<br />
<br />
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].<br />
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!<br />
<br />
</div><br />
<br />
= Roadmap =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Updated roadmap:<br />
Next 1.5 release, updated scoring:<br />
* Clarification of maturity levels (syntactic changes to keep the text consistent)<br />
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. <br />
* Show improvements with every activity introduced<br />
* Adapt for the new scoring method<br />
* Update questions for 4-tiers<br />
* Review and where necessary clarify current questions<br />
* Consider v1.1 remarks that were not withheld for the previous release<br />
Targeted completion date: February 28, 2017<br />
<br />
SAMM version 2.0<br />
* Core model changed<br />
* Visualisations + flavours for a few development methodologies<br />
* Update quickstart guide, TB, HTG. <br />
* Success metrics: How well does the model work: Linked to the benchmarking project.<br />
Timing: Workshops as part of OWASP Project Summit June 2017<br />
<br />
</div><br />
= Get Involved =<br />
[[Image:OwaspSAMM.png|right]]<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
Involvement in the development of SAMM is actively encouraged!<br />
<br />
You do not have to be a security expert in order to contribute.<br />
<br />
Some of the ways you can help:<br />
<br />
==Feedback==<br />
<br />
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:<br />
* What do like?<br />
* What don't you like?<br />
* How can we make SAMM easier to use?<br />
* How could SAMM be improved? <br />
<br />
<br />
==Localization==<br />
<br />
Are you fluent in another language? Can you help translate SAMM into that language?<br />
<br />
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!<br />
<br />
</div><br />
<br />
= Project Sponsors =<br />
[[Image:OwaspSAMM.png|right]]<br />
<br />
<div style="font-size:120%;border:none;margin: 0;color:#000"><br />
<br />
SAMM is developed and maintained by a worldwide team of volunteers. We have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM.<br />
<br />
==SAMM Adopters==<br />
SAMM is the premier open source software assurance framework. You can find a list of [https://www.owasp.org/index.php/OpenSAMM_Adopters SAMM adopters] online.<br />
<br />
==Call for SAMM2 Sponsors==<br />
OWASP SAMM and the upcoming SAMM 2.0 release is the open source software security maturity model used to develop secure software for IT, application and software security technologists. <br />
<br />
We are seeking sponsors to support OWASP SAMM. All proceeds from the sponsorship support the mission of the OWASP Foundation and the further development of SAMM. Supporting the project drives the funding for research grants, SAMM hosting, tools, templates, documents, promotion, and more.<br />
<br />
By sponsoring SAMM, you not only support an important and flagship OWASP project, you will also get visibility during the next SAMM Summit (part of the OWASP Summit 2018) and recognition on the OWASP SAMM project web site and the next release of SAMM (version 2.0).<br />
<br />
For more information: Download our [https://www.owasp.org/images/f/fb/OWASP_SAMM2_Sponsorship_Form_v20170212.pdf SAMM2 sponsorship brochure].<br />
<br />
Contact [mailto:seba@owasp.org seba@owasp.org] to activate your sponsorship.<br />
<br />
==== Acknowledgements ====<br />
<br />
<br />
<br />
We would like to thank the following sponsors who donated funds to our project:<br />
<br />
[[File:OWASP-NoVA-Chapter-Logo.PNG|250px|link=https://www.owasp.org/index.php/Virginia]]<br />
[[File:Belgium_Chapter.PNG|250px|link=https://www.owasp.org/index.php/Belgium]]<br />
[[File:London_Chapter.PNG|250px|link=https://www.owasp.org/index.php/London]]<br />
<br />
[[File:Aspectsecurity.png|250px|link=http://www.aspectsecurity.com]]<br />
[[File:Astech_Consulting_logo.png|250px|link=http://www.astechconsulting.com/]] <br />
[[File:Denim_Group_logo.jpg|250px|link=http://www.denimgroup.com/]] <br />
[[File:Gotham_Digital_Science_logo.jpg|250px|link=http://www.gdssecurity.com/]] <br />
<br />
{{MemberLinksv2|link=http://www.hpenterprisesecurity.com|logo=HP_Blue_RGB_150_SM.png|size=300px90px}} <br />
[[File:NetSPI_logo.png|250px|link=http://www.netspi.com/]] <br />
[[Image:PwC_logo_4colourprint_(2)_Resized_good_one.jpg|150px|link=http://www.pwc.com]]<br />
[[File:SI_Logo_Stacked_Application_Security.jpg|250px|link=http://www.securityinnovation.com/]] <br />
[[File:LogoToreon.jpg|250px|link=http://www.toreon.com]] <br />
[[File:Veracode-samm.png|250px|link=http://www.veracode.com]] <br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
<br /><br />
{{OWASP Book|6888083}}<br />
<br /><br />
<br />
[[Category:OWASP Project|Zed Attack Proxy Project]]<br />
[[Category:OWASP_Tool]]<br />
[[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]]<br />
[[Category:OWASP_Download]]<br />
[[Category:Popular]]</div>Sdeleersnyder