SAMM - Deployment - Revision history

Pravir Chandra at 00:50, 5 May 2009

2009-05-05T00:50:31Z

Pravir Chandra at 17:53, 2 May 2009

2009-05-02T17:53:03Z

Pravir Chandra at 03:09, 2 May 2009

2009-05-02T03:09:09Z

Pravir Chandra at 02:15, 2 May 2009

2009-05-02T02:15:02Z

Pravir Chandra at 22:57, 1 May 2009

2009-05-01T22:57:25Z

Pravir Chandra at 22:56, 1 May 2009

2009-05-01T22:56:26Z

Pravir Chandra: New page: http://www.opensamm.org/badges/small/D.png ===Vulnerability Management=== The Vulnerability Management (VM) Practice is focused on the processes within an organization with respect to han...

2009-05-01T22:54:48Z

New page: http://www.opensamm.org/badges/small/D.png ===Vulnerability Management=== The Vulnerability Management (VM) Practice is focused on the processes within an organization with respect to han...

New page

http://www.opensamm.org/badges/small/D.png

===Vulnerability Management===
The Vulnerability Management (VM) Practice is focused on the processes within an organization with respect to handling vulnerability reports and operational incidents. By having these processes in place, an organization’s projects will have consistent expectations and increased efficiency for handling these events, rather than chaotic and uninformed responses.

Starting from lightweight assignment of roles in the event of an incident, an organization grows into a more formal incident response process that ensures visibility and tracking on issues that occur. Communications are also improved to improve overall understanding of the processes.

In an advanced form, vulnerability management involves thorough dissecting of incidents and vulnerability reports to collect detailed metrics and other root-cause information to feedback into the organization’s downstream behavior.
{| cellpadding="10"
|[http://www.owasp.org/index.php/SAMM_-_Vulnerability_Management_-_1 http://www.opensamm.org/badges/small/VM1.png]
|[http://www.owasp.org/index.php/SAMM_-_Vulnerability_Management_-_2 http://www.opensamm.org/badges/small/VM2.png]
|[http://www.owasp.org/index.php/SAMM_-_Vulnerability_Management_-_3 http://www.opensamm.org/badges/small/VM3.png]
|}

===Environment Hardening===
The Environment Hardening (EH) Practice is focused on building assurance for the runtime environment that hosts the organization’s software. Since secure operation of an application can be deteriorated by problems in external components, hardening this underlying infrastructure directly improves the overall security posture of the software.

By starting with simple tracking and distributing of information about the operating environment to keep development teams better informed, an organization evolves to scalable methods for managing deployment of security patches and instrumenting the operating environment with early-warning detectors for potential security issues before damage is done.

As an organization advances, the operating environment is further reviewed and hardened by deployment of protection tools to add layers of defenses and safety nets to limit damage in case any vulnerabilities are exploited.
{| cellpadding="10"
|[http://www.owasp.org/index.php/SAMM_-_Environment_Hardening_-_1 http://www.opensamm.org/badges/small/EH1.png]
|[http://www.owasp.org/index.php/SAMM_-_Environment_Hardening_-_2 http://www.opensamm.org/badges/small/EH2.png]
|[http://www.owasp.org/index.php/SAMM_-_Environment_Hardening_-_3 http://www.opensamm.org/badges/small/EH3.png]
|}

===Operational Enablement===
The Operational Enablement (OE) Practice is focused on gathering security critical information from the project teams building software and communicating it to the users and operators of the software. Without this information, even the most securely designed software carries undue risks since important security characteristics and choices will not be known at a deployment site.

Starting from lightweight documentation to capture the most impactful details for users and operators, an organization evolves toward building complete operational security guides that are delivered with each release.

In an advanced form, operational enablement also entails organization-level checks against individual project teams to ensure that information is being captured and shared according to expectations.
{| cellpadding="10"
|[http://www.owasp.org/index.php/SAMM_-_Operational_Enablement_-_1 http://www.opensamm.org/badges/small/OE1.png]
|[http://www.owasp.org/index.php/SAMM_-_Operational_Enablement_-_2 http://www.opensamm.org/badges/small/OE2.png]
|[http://www.owasp.org/index.php/SAMM_-_Operational_Enablement_-_3 http://www.opensamm.org/badges/small/OE3.png]
|}

@@ Line 1: / Line 1: @@
 {{OpenSAMM}}
 <div style="float:left; width:65%;">
 http://www.opensamm.org/badges/small/D.png

@@ Line 1: / Line 1: @@
 {{OpenSAMM}}
 [[Category:OWASP Software Assurance Maturity Model Project]]
 http://www.opensamm.org/badges/small/D.png
+<div style="width:100%; float:left;"><br/><br/>
 ===Vulnerability Management===
 The Vulnerability Management (VM) Practice is focused on the processes within an organization with respect to handling vulnerability reports and operational incidents. By having these processes in place, an organization’s projects will have consistent expectations and increased efficiency for handling these events, rather than chaotic and uninformed responses.
@@ Line 29: / Line 34: @@
 In an advanced form, operational enablement also entails organization-level checks against individual project teams to ensure that information is being captured and shared according to expectations.
 {{SAMM-BadgeList|name=Operational_Enablement|abbr=OE}}

← Older revision		Revision as of 02:15, 2 May 2009
Line 1:		Line 1:
		+	{{OpenSAMM}}
	[[Category:OWASP Software Assurance Maturity Model Project]]		[[Category:OWASP Software Assurance Maturity Model Project]]
	http://www.opensamm.org/badges/small/D.png		http://www.opensamm.org/badges/small/D.png

← Older revision		Revision as of 22:57, 1 May 2009
Line 1:		Line 1:
	[[Category:OWASP Software Assurance Maturity Model Project]]		[[Category:OWASP Software Assurance Maturity Model Project]]
		+	http://www.opensamm.org/badges/small/D.png

−	~~http://www.opensamm.org/badges/small/D.png~~

	===Vulnerability Management===		===Vulnerability Management===

← Older revision		Revision as of 22:56, 1 May 2009
Line 1:		Line 1:
		+	[[Category:OWASP Software Assurance Maturity Model Project]]
		+
	http://www.opensamm.org/badges/small/D.png		http://www.opensamm.org/badges/small/D.png

@@ Line 10: / Line 10: @@
 In an advanced form, vulnerability management involves thorough dissecting of incidents and vulnerability reports to collect detailed metrics and other root-cause information to feedback into the organization’s downstream behavior.
-{| cellpadding="10"
+{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM}}
@@ Line 23: / Line 19: @@
 As an organization advances, the operating environment is further reviewed and hardened by deployment of protection tools to add layers of defenses and safety nets to limit damage in case any vulnerabilities are exploited.
-{| cellpadding="10"
+{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH}}
@@ Line 36: / Line 28: @@
 In an advanced form, operational enablement also entails organization-level checks against individual project teams to ensure that information is being captured and shared according to expectations.
-{| cellpadding="10"
+{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE}}