Markdown Editor
Ouvrir l'éditeur

Kit programme de sécurité applicative

Piloter un programme AppSec : maturité SAMM, feuille de route Secure by Design, preuves SSDF, security champions, modèles de menaces, revues, pentests et PSIRT.

Étape 1

Stratégie

  1. OWASP SAMM Assessment Template

    Complet

    OWASP SAMM v2 assessment: 15 practices and 30 streams, original prompts per level, scoring formulas, current vs target scores, findings, phased roadmap, metrics

    OWASP SAMM v2 (core v2.2.0)

  2. Secure by Design Roadmap Template (CISA Pledge)

    Complet

    Secure by Design roadmap: executive owner, 3 principles, 7 pledge goals with measures, memory-safety roadmap, bad practices check, evidence, reporting

    CISA Secure by Design (Oct 2023); Secure by Design Pledge (May 2024)

  3. SSDF Self-Assessment and Attestation Template (NIST SP 800-218)

    Complet

    SSDF 1.1 self-assessment by task (PO, PS, PW, RV), status scale and scoring, evidence, POA&M, exceptions, v1.2 draft and AI profile supplements, attestation

    NIST SP 800-218 SSDF 1.1; SP 800-218r1 ipd; SP 800-218A
Étape 2

Entraînement

  1. Security Champions Programme Charter Template (OWASP)

    Complet

    Security champions charter: vision, goals, selection, time allocation, training path, duties, rituals, metrics, recognition, rotation, OWASP and SAMM mapping

    OWASP Security Champions Guide; OWASP SAMM v2 Education and Guidance

  2. Secure Coding Standard Template

    Standard

    Secure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process

Étape 3

Modélisation des menaces

  1. Threat Model Template (STRIDE)

    Complet

    STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance

    STRIDE
Étape 4

Vérification

  1. Security Design Review Template (OWASP ASVS 5.0)

    Complet

    Design-time security review by the 17 OWASP ASVS 5.0 chapters: scope, DFD, threats, level, findings, remediation, sign-off

    OWASP ASVS 5.0

  2. Penetration Test Report Template (PTES, OWASP WSTG)

    Complet

    Pentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest

    PTES; OWASP Web Security Testing Guide
Étape 5

Évaluations

  1. Supplier Security Assessment Template

    Standard

    Vendor vetting + ongoing monitoring

Étape 6

Gestion des incidents

  1. PSIRT Vulnerability Handling Procedure Template (ISO/IEC 30111, CVSS v4)

    Complet

    Producer-side PSIRT procedure: intake, verification, CVSS v4.0, EPSS, KEV and SSVC triage, remediation targets, advisory and VEX, CVE/CNA, CRA Art. 14, metrics

    ISO/IEC 30111:2019 (structure); CVSS v4.0; CISA SSVC; CNA Rules 4.2.0; EU CRA Art. 14