Secure Agile Development According To SAMM
summary
OWASP SAM gets a narrowly scoped Agile extension: a published SAM Agile notes set that adds triggers and pick lists so story refinement yields specific instructions and acceptance tests, not a 400‑rule wiki. Automation (SAST/DAST/security unit tests) handles routine checks while the process minimizes repeated expert work by supplying situational instructions and ready‑made tests. Example: a timing flaw in password reset becomes a concrete requirement to equalize response time. Metrics tie into definition of done.
AI-written summary · about
chapters (12)
- 0:00Introduction and context
- 2:13Evolution of software methods
- 4:24The challenge of BSIMM/SAMM
- 5:43Agile security realities
- 7:24Common agile security pitfalls
- 11:14Developing the agile notes
- 13:35Core principles for agile
- 17:13Situational security approach
- 20:54Requirements and testing flow
- 25:56Integration into agile process
- 29:01Metrics and future outlook
- 32:22Q&A session
related talks
33mIntroduction to OWASP SAMM for Software Developers: Building Secure Software
44mMaturing SDLC At A Fortune 500 Company Based On OWASP SAMM: Successes And Pitfalls
55mInc. Your sw Assurance /w OWASP SAMM V2.1
01h 00mSAMM Project
36mOWASP SAMM 2 Your Dynamic Software Security Journey
28mFlagship Projects: Software Assurance Maturity Model (SAMM)
32mSAMM: Interactive Introduction And Update
26mOWASP Software Assurance Maturity Model (SAMM)