Maturing SDLC At A Fortune 500 Company Based On OWASP SAMM: Successes And Pitfalls
summary
Company adopts OWASP SAMM as measurable SDLC standard, rolls it out across 30 teams starting 2022, moves from spreadsheets to a COTS dashboard, enforces weekly reporting and business‑unit security leads (10–12 hours initial effort then 1–3 hours ongoing). Targets use a percent‑to‑target metric per team instead of raw scores. A vulnerability risk aggregator (CodeQL GitHub Orca Tenable Synopsys inputs) produces a 0–10 risk number that inversely correlates with SAMM scores. Acquisitions use SAMM for due diligence; OWASP benchmark average is 1.43.
AI-written summary · about
chapters (20)
- 0:00Application security challenges
- 2:31Customer trust drives security
- 4:59Choosing OWASP SAMM
- 7:08SAMM journey with spreadsheets
- 8:35Standardizing 15 product lines
- 10:22Overcoming team skepticism
- 12:29Common security vocabulary
- 14:15Gamification and score inflation
- 15:59Percentage-based targets
- 17:25Tailoring targets to risk
- 19:52Measuring risk scores
- 23:04SAMM scores vs risk reduction
- 24:28SAMM for acquisitions
- 27:38Unintended benefits of SAMM
- 31:45Threat modeling for product refreshes
- 34:33SAMM in customer RFPs
- 37:46SAMM over NIST
- 40:21SAMM ease of implementation
- 41:44SAMM for AI products
- 43:14SAMM impact on SDLC
related talks
33mIntroduction to OWASP SAMM for Software Developers: Building Secure Software
01h 00mSAMM Project
26mOWASP Software Assurance Maturity Model (SAMM)
28mFlagship Projects: Software Assurance Maturity Model (SAMM)
55mInc. Your sw Assurance /w OWASP SAMM V2.1
46mOWASP SAMM2: Your Dynamic Software Security Journey
36mOWASP SAMM 2 Your Dynamic Software Security Journey
34mSecure Agile Development According To SAMM