Набір програми безпеки застосунків
Керування програмою AppSec: зрілість за SAMM, дорожня карта Secure by Design, докази SSDF, security champions, моделі загроз, рев'ю, пентести і PSIRT.
Стратегія
OWASP SAMM Assessment Template
ПовнийOWASP SAMM v2 assessment: 15 practices and 30 streams, original prompts per level, scoring formulas, current vs target scores, findings, phased roadmap, metrics
OWASP SAMM v2 (core v2.2.0)Secure by Design Roadmap Template (CISA Pledge)
ПовнийSecure by Design roadmap: executive owner, 3 principles, 7 pledge goals with measures, memory-safety roadmap, bad practices check, evidence, reporting
CISA Secure by Design (Oct 2023); Secure by Design Pledge (May 2024)SSDF Self-Assessment and Attestation Template (NIST SP 800-218)
ПовнийSSDF 1.1 self-assessment by task (PO, PS, PW, RV), status scale and scoring, evidence, POA&M, exceptions, v1.2 draft and AI profile supplements, attestation
NIST SP 800-218 SSDF 1.1; SP 800-218r1 ipd; SP 800-218A
Практика
Security Champions Programme Charter Template (OWASP)
ПовнийSecurity champions charter: vision, goals, selection, time allocation, training path, duties, rituals, metrics, recognition, rotation, OWASP and SAMM mapping
OWASP Security Champions Guide; OWASP SAMM v2 Education and GuidanceSecure Coding Standard Template
СтандартSecure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process
Моделювання загроз
Верифікація
Security Design Review Template (OWASP ASVS 5.0)
ПовнийDesign-time security review by the 17 OWASP ASVS 5.0 chapters: scope, DFD, threats, level, findings, remediation, sign-off
OWASP ASVS 5.0Penetration Test Report Template (PTES, OWASP WSTG)
ПовнийPentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest
PTES; OWASP Web Security Testing Guide