Markdown Editor
Mở trình soạn thảo

Bộ mẫu chương trình bảo mật ứng dụng

Vận hành chương trình AppSec: mức trưởng thành SAMM, lộ trình Secure by Design, bằng chứng SSDF, security champion, mô hình mối đe dọa, review, pentest và PSIRT.

Bước 1

Chiến lược

  1. OWASP SAMM Assessment Template

    Đầy đủ

    OWASP SAMM v2 assessment: 15 practices and 30 streams, original prompts per level, scoring formulas, current vs target scores, findings, phased roadmap, metrics

    OWASP SAMM v2 (core v2.2.0)

  2. Secure by Design Roadmap Template (CISA Pledge)

    Đầy đủ

    Secure by Design roadmap: executive owner, 3 principles, 7 pledge goals with measures, memory-safety roadmap, bad practices check, evidence, reporting

    CISA Secure by Design (Oct 2023); Secure by Design Pledge (May 2024)

  3. SSDF Self-Assessment and Attestation Template (NIST SP 800-218)

    Đầy đủ

    SSDF 1.1 self-assessment by task (PO, PS, PW, RV), status scale and scoring, evidence, POA&M, exceptions, v1.2 draft and AI profile supplements, attestation

    NIST SP 800-218 SSDF 1.1; SP 800-218r1 ipd; SP 800-218A
Bước 2

Luyện tập

  1. Security Champions Programme Charter Template (OWASP)

    Đầy đủ

    Security champions charter: vision, goals, selection, time allocation, training path, duties, rituals, metrics, recognition, rotation, OWASP and SAMM mapping

    OWASP Security Champions Guide; OWASP SAMM v2 Education and Guidance

  2. Secure Coding Standard Template

    Chuẩn

    Secure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process

Bước 3

Mô hình mối đe dọa

  1. Threat Model Template (STRIDE)

    Đầy đủ

    STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance

    STRIDE
Bước 4

Kiểm chứng

  1. Security Design Review Template (OWASP ASVS 5.0)

    Đầy đủ

    Design-time security review by the 17 OWASP ASVS 5.0 chapters: scope, DFD, threats, level, findings, remediation, sign-off

    OWASP ASVS 5.0

  2. Penetration Test Report Template (PTES, OWASP WSTG)

    Đầy đủ

    Pentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest

    PTES; OWASP Web Security Testing Guide
Bước 5

Đánh giá tác động

  1. Supplier Security Assessment Template

    Chuẩn

    Vendor vetting + ongoing monitoring

Bước 6

Sự cố

  1. PSIRT Vulnerability Handling Procedure Template (ISO/IEC 30111, CVSS v4)

    Đầy đủ

    Producer-side PSIRT procedure: intake, verification, CVSS v4.0, EPSS, KEV and SSVC triage, remediation targets, advisory and VEX, CVE/CNA, CRA Art. 14, metrics

    ISO/IEC 30111:2019 (structure); CVSS v4.0; CISA SSVC; CNA Rules 4.2.0; EU CRA Art. 14