clement13.net
Original photo: Haute muraille de pierre d'une enceinte fortifiée longeant un chemin.
Description
Haute muraille de pierre d'une enceinte fortifiée longeant un chemin.
Source
En Merker · original page
Licence
CC0 Public domain
Original photo, unretouched. The background is a version of it stylised by the site.

Software security — OWASP SAMM

How do you measure and improve the security of the development life cycle, practice by practice, without trying to do everything at once?

≈ 2 min readReading
At a glance
  • 5 functions, 15 practices.
  • Levels 1 to 3 per practice (0 = starting point).
  • Target profile proportionate to risk.
On this page
  1. Profile
  2. Why this matrix matters in my field
  3. The maturity scale
    1. Implicit starting point
    2. Initial implementation
    3. Structured realization
    4. Optimized operation
  4. The dimensions assessed
    1. Governance — Strategy & Metrics
    2. Governance — Policy & Compliance
    3. Governance — Education & Guidance
    4. Design — Threat Assessment
    5. Design — Security Requirements
    6. Design — Security Architecture
    7. Implementation — Secure Build
    8. Implementation — Secure Deployment
    9. Implementation — Defect Management
    10. Verification — Architecture Assessment
    11. Verification — Requirements-driven Testing
    12. Verification — Security Testing
    13. Operations — Incident Management
    14. Operations — Environment Management
    15. Operations — Operational Management
  5. How to use it
  6. Limitations and precautions
  7. Sources and verification

Profile#

Organization
OWASP (Open Worldwide Application Security Project)
Model
Software Assurance Maturity Model (SAMM), version 2
Structure
5 business functions, 15 security practices, 2 streams per practice
Scale
Maturity levels 1 to 3 for each practice; level 0 is the implicit starting point
Access
Free and open; assessment toolbox available

Why this matrix matters in my field#

Security “by design” is a permanent requirement for a team that ships software. SAMM turns that requirement into a roadmap: which practices (threats, requirements, architecture, testing, incidents…), at what level, and in what order. It also makes visible what belongs to development and what belongs to operations.

The maturity scale#

Each practice is assessed on three cumulative levels. Level 0 is the implicit starting point: the practice's activities are not fulfilled.

  1. Implicit starting point#

    The practice's activities are not fulfilled.

  2. Initial implementation#

    Initial understanding and implementation of the practice, ad hoc or partial.

  3. Structured realization#

    More effective and better-structured practice: defined, repeated, tracked.

  4. Optimized operation#

    Full mastery of the practice, at scale, with continuous improvement.

The dimensions assessed#

Five business functions group fifteen practices (official names in italics).

  • Governance — Strategy & Metrics#

    Strategy & Metrics

  • Governance — Policy & Compliance#

    Policy & Compliance

  • Governance — Education & Guidance#

    Education & Guidance

  • Design — Threat Assessment#

    Threat Assessment

  • Design — Security Requirements#

    Security Requirements

  • Design — Security Architecture#

    Security Architecture

  • Implementation — Secure Build#

    Secure Build

  • Implementation — Secure Deployment#

    Secure Deployment

  • Implementation — Defect Management#

    Defect Management

  • Verification — Architecture Assessment#

    Architecture Assessment

  • Verification — Requirements-driven Testing#

    Requirements-driven Testing

  • Verification — Security Testing#

    Security Testing

  • Operations — Incident Management#

    Incident Management

  • Operations — Environment Management#

    Environment Management

  • Operations — Operational Management#

    Operational Management

How to use it#

  1. Assess the fifteen practices (questionnaire provided by SAMM).
  2. Set a target profile suited to the risk, practice by practice.
  3. Build a roadmap in stages (often quarter by quarter).
  4. Reassess to measure progress.

Limitations and precautions#

  • SAMM measures practices, not the absence of vulnerabilities: a good score is not a guarantee.
  • It replaces neither an external audit nor a certification (for example ISO/IEC 27001, which verifies a management system).
  • The levels are cumulative: skipping level 1 to aim for level 3 is counterproductive.

Sources and verification#