Kit de programa de seguridad de aplicaciones
Dirigir un programa AppSec: madurez SAMM, hoja de ruta Secure by Design, evidencias SSDF, security champions, modelos de amenazas, revisiones, pentests y PSIRT.
Estrategia
OWASP SAMM Assessment Template
CompletaOWASP SAMM v2 assessment: 15 practices and 30 streams, original prompts per level, scoring formulas, current vs target scores, findings, phased roadmap, metrics
OWASP SAMM v2 (core v2.2.0)Secure by Design Roadmap Template (CISA Pledge)
CompletaSecure by Design roadmap: executive owner, 3 principles, 7 pledge goals with measures, memory-safety roadmap, bad practices check, evidence, reporting
CISA Secure by Design (Oct 2023); Secure by Design Pledge (May 2024)SSDF Self-Assessment and Attestation Template (NIST SP 800-218)
CompletaSSDF 1.1 self-assessment by task (PO, PS, PW, RV), status scale and scoring, evidence, POA&M, exceptions, v1.2 draft and AI profile supplements, attestation
NIST SP 800-218 SSDF 1.1; SP 800-218r1 ipd; SP 800-218A
Práctica
Security Champions Programme Charter Template (OWASP)
CompletaSecurity champions charter: vision, goals, selection, time allocation, training path, duties, rituals, metrics, recognition, rotation, OWASP and SAMM mapping
OWASP Security Champions Guide; OWASP SAMM v2 Education and GuidanceSecure Coding Standard Template
EstándarSecure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process
Modelado de amenazas
Verificación
Security Design Review Template (OWASP ASVS 5.0)
CompletaDesign-time security review by the 17 OWASP ASVS 5.0 chapters: scope, DFD, threats, level, findings, remediation, sign-off
OWASP ASVS 5.0Penetration Test Report Template (PTES, OWASP WSTG)
CompletaPentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest
PTES; OWASP Web Security Testing Guide