SAMM - Governance - Revision history

Pravir Chandra at 00:52, 5 May 2009

2009-05-05T00:52:04Z

Pravir Chandra at 17:54, 2 May 2009

2009-05-02T17:54:50Z

Pravir Chandra at 17:51, 2 May 2009

2009-05-02T17:51:08Z

Pravir Chandra at 01:55, 2 May 2009

2009-05-02T01:55:10Z

Pravir Chandra at 22:56, 1 May 2009

2009-05-01T22:56:54Z

Pravir Chandra at 22:55, 1 May 2009

2009-05-01T22:55:58Z

Pravir Chandra at 22:48, 1 May 2009

2009-05-01T22:48:25Z

Pravir Chandra: New page: http://www.opensamm.org/badges/small/G.png ===Strategy & Metrics=== The Strategy & Metrics (SM) Practice is focused on establishing the framework within an organization for a software sec...

2009-05-01T22:43:46Z

New page: http://www.opensamm.org/badges/small/G.png ===Strategy & Metrics=== The Strategy & Metrics (SM) Practice is focused on establishing the framework within an organization for a software sec...

New page

http://www.opensamm.org/badges/small/G.png

===Strategy & Metrics===
The Strategy & Metrics (SM) Practice is focused on establishing the framework within an organization for a software security assurance program. This is the most fundamental step in defining security goals in a way that’s both measurable and aligned with the organization’s real business risk.
By starting with lightweight risk profiles, an organization grows into more advanced risk classification schemes for application and data assets over time. With additional insight on relative risk measures, an organization can tune its project-level security goals and develop granular roadmaps to make the security program more efficient.
At the more advanced levels within this Practice, an organization draws upon many data sources, both internal and external, to collect metrics and qualitative feedback on the security program. This allows fine tuning of cost outlay versus the realized benefit at the program level.
{| cellpadding="10"
|[http://www.owasp.org/index.php/SAMM_-_Strategy_&_Metrics_-_1 http://www.opensamm.org/badges/small/SM1.png]
|[http://www.owasp.org/index.php/SAMM_-_Strategy_&_Metrics_-_2 http://www.opensamm.org/badges/small/SM2.png]
|[http://www.owasp.org/index.php/SAMM_-_Strategy_&_Metrics_-_3 http://www.opensamm.org/badges/small/SM3.png]
|}

===Policy & Compliance===
The Policy & Compliance (PC) Practice is focused on understanding and meeting external legal and regulatory requirements while also driving internal security standards to ensure compliance in a way that’s aligned with the business purpose of the organization.
A driving theme for improvement within this Practice is focus on project-level audits that gather information about the organization’s behavior in order to check that expectations are being met. By introducing routine audits that start out lightweight and grow in depth over time, organizational change is achieved iteratively.
In a sophisticated form, provision of this Practice entails organization-wide understanding of both internal standards and external compliance drivers while also maintaining low-latency checkpoints with project teams to ensure no project is operating outside expectations without visibility.
{| cellpadding="10"
|[http://www.owasp.org/index.php/SAMM_-_Policy_&_Compliance_-_1 http://www.opensamm.org/badges/small/PC1.png]
|[http://www.owasp.org/index.php/SAMM_-_Policy_&_Compliance_-_2 http://www.opensamm.org/badges/small/PC2.png]
|[http://www.owasp.org/index.php/SAMM_-_Policy_&_Compliance_-_3 http://www.opensamm.org/badges/small/PC3.png]
|}

===Education & Guidance===
The Education & Guidance (EG) Practice is focused on arming personnel involved in the software life-cycle with knowledge and resources to design, develop, and deploy secure software. With improved access to information, project teams will be better able to proactively identify and mitigate the specific security risks that apply to their organization.
One major theme for improvement across the Objectives is providing training for employees, either through instructor-led sessions or computer-based modules. As an organization progresses, a broad base of training is built by starting with developers and moving to other roles throughout the organization, culminating with the addition of role-based certification to ensure comprehension of the material.
In addition to training, this Practice also requires pulling security-relevant information into guidelines that serve as reference information to staff. This builds a foundation for establishing a baseline expectation for security practices in your organization, and later allows for incremental improvement once usage of the guidelines has been adopted.
{| cellpadding="10"
|[http://www.owasp.org/index.php/SAMM_-_Education_&_Guidance_-_1 http://www.opensamm.org/badges/small/EG1.png]
|[http://www.owasp.org/index.php/SAMM_-_Education_&_Guidance_-_2 http://www.opensamm.org/badges/small/EG2.png]
|[http://www.owasp.org/index.php/SAMM_-_Education_&_Guidance_-_3 http://www.opensamm.org/badges/small/EG3.png]
|}

@@ Line 1: / Line 1: @@
 {{OpenSAMM}}
 <div style="float:left; width:65%;">
 http://www.opensamm.org/badges/small/G.png

@@ Line 1: / Line 1: @@
 {{OpenSAMM}}
 [[Category:OWASP Software Assurance Maturity Model Project]]
 http://www.opensamm.org/badges/small/G.png
+<div style="width:100%; float:left;"><br/><br/>
 ===Strategy & Metrics===
 The Strategy & Metrics (SM) Practice is focused on establishing the framework within an organization for a software security assurance program. This is the most fundamental step in defining security goals in a way that’s both measurable and aligned with the organization’s real business risk.
@@ Line 41: / Line 46: @@
 |[http://www.owasp.org/index.php/SAMM_-_Education_&_Guidance_-_3 http://www.opensamm.org/badges/small/EG3.png]
 |}

← Older revision		Revision as of 01:55, 2 May 2009
Line 1:		Line 1:
		+	{{OpenSAMM}}
	[[Category:OWASP Software Assurance Maturity Model Project]]		[[Category:OWASP Software Assurance Maturity Model Project]]
	http://www.opensamm.org/badges/small/G.png		http://www.opensamm.org/badges/small/G.png

← Older revision		Revision as of 22:56, 1 May 2009
Line 1:		Line 1:
	[[Category:OWASP Software Assurance Maturity Model Project]]		[[Category:OWASP Software Assurance Maturity Model Project]]
		+	http://www.opensamm.org/badges/small/G.png

−	~~http://www.opensamm.org/badges/small/G.png~~

	===Strategy & Metrics===		===Strategy & Metrics===

← Older revision		Revision as of 22:55, 1 May 2009
Line 1:		Line 1:
		+	[[Category:OWASP Software Assurance Maturity Model Project]]
		+
	http://www.opensamm.org/badges/small/G.png		http://www.opensamm.org/badges/small/G.png

@@ Line 15: / Line 15: @@
 At the more advanced levels within this Practice, an organization draws upon many data sources, both internal and external, to collect metrics and qualitative feedback on the security program. This allows fine tuning of cost outlay versus the realized benefit at the program level.
-{| cellpadding="10"
+{{SAMM-BadgeList|name=Strategy_&_Metrics|abbr=SM}}
@@ Line 28: / Line 24: @@
 In a sophisticated form, provision of this Practice entails organization-wide understanding of both internal standards and external compliance drivers while also maintaining low-latency checkpoints with project teams to ensure no project is operating outside expectations without visibility.
-{| cellpadding="10"
+{{SAMM-BadgeList|name=Policy_&_Compliance|abbr=PC}}
@@ Line 41: / Line 33: @@
 In addition to training, this Practice also requires pulling security-relevant information into guidelines that serve as reference information to staff.  This builds a foundation for establishing a baseline expectation for security practices in your organization, and later allows for incremental improvement once usage of the guidelines has been adopted.
-{| cellpadding="10"
+{{SAMM-BadgeList|name=Education_&_Guidance|abbr=EG}}
-|[http://www.owasp.org/index.php/SAMM_-_Education_&_Guidance_-_1 http://www.opensamm.org/badges/small/EG1.png]
 </div>

@@ Line 3: / Line 3: @@
 ===Strategy & Metrics===
 The Strategy & Metrics (SM) Practice is focused on establishing the framework within an organization for a software security assurance program. This is the most fundamental step in defining security goals in a way that’s both measurable and aligned with the organization’s real business risk.
 By starting with lightweight risk profiles, an organization grows into more advanced risk classification schemes for application and data assets over time.  With additional insight on relative risk measures, an organization can tune its project-level security goals and develop granular roadmaps to make the security program more efficient.
 At the more advanced levels within this Practice, an organization draws upon many data sources, both internal and external, to collect metrics and qualitative feedback on the security program. This allows fine tuning of cost outlay versus the realized benefit at the program level.
 {| cellpadding="10"
@@ Line 14: / Line 16: @@
 ===Policy & Compliance===
 The Policy & Compliance (PC) Practice is focused on understanding and meeting external legal and regulatory requirements while also driving internal security standards to ensure compliance in a way that’s aligned with the business purpose of the organization.
 A driving theme for improvement within this Practice is focus on project-level audits that gather information about the organization’s behavior in order to check that expectations are being met. By introducing routine audits that start out lightweight and grow in depth over time, organizational change is achieved iteratively.
 In a sophisticated form, provision of this Practice entails organization-wide understanding of both internal standards and external compliance drivers while also maintaining low-latency checkpoints with project teams to ensure no project is operating outside expectations without visibility.
 {| cellpadding="10"
@@ Line 25: / Line 29: @@
 ===Education & Guidance===
 The Education & Guidance (EG) Practice is focused on arming personnel involved in the software life-cycle with knowledge and resources to design, develop, and deploy secure software.  With improved access to information, project teams will be better able to proactively identify and mitigate the specific security risks that apply to their organization.
 One major theme for improvement across the Objectives is providing training for employees, either through instructor-led sessions or computer-based modules.  As an organization progresses, a broad base of training is built by starting with developers and moving to other roles throughout the organization, culminating with the addition of role-based certification to ensure comprehension of the material.
 In addition to training, this Practice also requires pulling security-relevant information into guidelines that serve as reference information to staff.  This builds a foundation for establishing a baseline expectation for security practices in your organization, and later allows for incremental improvement once usage of the guidelines has been adopted.
 {| cellpadding="10"