OWASP SAMM Assessments

OWASP SAMM as a model is built around the principle of regular assessments. SAMMY turns this into a continuous process. Either way situations will have to be assessed, benchmarked and analyzed. There are several ways you can go about this, self assessment, external assessment and validation audits.

OWASP SAMM Self Assessments

Self assessment is the quickest and most accessible way to get started with OWASP SAMM. The best way to do this is to assign each activity to the most relevant stakeholder for evaluation. These stakeholders should be in a role that gives them clear visibility to the process being analyzed and he should have access to the documentation. Their findings and the evidence to support their statements are uploaded in the SAMMY system. In this case the validator is an internal supervisor that reviews the statements and supporting evidence.

Everybody likes to get good scores, and the natural tendency in self assessment is to be too lenient with the required thresholds. But not always, sometimes teams are too hard on themselves. That is where the role of validator comes in, it is his or her responsibility to check whether adequate evidence is presented to clear a given threshold.    

OWASP SAMM External Assessment

The more objective way to do this is via an external assessment. Here the external assessor will fill in the model together with each stakeholder. Codific can be your external assessor. Having done these types of assessments for many different products and organizations we have a deep understanding of the nuances and the expectation on each activity. An external assessment is also the preferred assessment type when OWASP SAMM is used in a supplier audit.

Together with your team we will define your organization’s targets and recommend a security implementation roadmap. Note that SAMM does not insist that all organizations achieve nor aspire to obtain maturity level 3 in each category. Hence, your security growth strategy will be tailored to the risks your organization is facing.

OWASP SAMM Validation Audit

The third option is a hybrid of the self assessment and the external assessment. The stakeholders self assess but the validator is an external auditor rather than an internal supervisor. Codific can be your external auditor. The auditor reviews the evidence presented by the different stakeholders on each activity and evaluates the proposed maturity level. When the auditor rejects a given maturity level on an activity he provides information as to why, and a suggestion of the current maturity level. The stakeholders resubmit until all activities are validated and maturity levels are established.

OWASP SAMM Assessment Training

OWASP SAMM as a model is high level prescriptive. This is by design to be broadly applicable in different contexts. The disadvantage of this is that the specific implementation in your context may create some ambiguity. In order to address the implementation, extensive guidance has been provided by the OWASP community linking the different activities to the different OWASP projects providing tools and standards. To accelerate your team’s learning curve with OWASP SAMM we also offer a one-day SAMM training. During the hands-on workshop we will do a deep-dive into each of the 30 SAMM security streams. Every stream contains three maturity levels that prescribe progressive improvements in your security activities. Your team will get a thorough understanding of the complete security landscape.

SAMM Improvement Guidance

For each organization the priorities are different, and no organization should try to achieve maximum maturity on all activities. So where should you start? What are the low hanging fruits? And how exactly is the next maturity level implemented in those activities? Codific will passionately help you answer these and many more questions in either one of the assessments or trainings.