OWASP DevSecOps Maturity Model (DSOMM)
summary
Claims a practical DSOMM-based program that moves teams from Excel inventories to an inventory of production dependencies, runs 2 hour interview assessments per team, and prioritizes a two-activity roadmap rather than a three year plan. Demonstrates automation: metric collectors pulling from GitHub Confluence DefectDojo and heatmaps that show threat modeling frequency. Enforces SLAs, e g vulnerabilities high/critical ≤7 days, and recommends a maturity app instead of manual spreadsheets.
AI-written summary · about
chapters (9)
- 0:00OWASP DevSecOps Maturity Model intro
- 3:30Assessing applications foundation
- 7:05Analyzing security practices
- 10:18SAM versus DSOMM comparisons
- 13:50Planning security activities
- 17:45Defining realistic roadmap
- 21:37Implementing improvements
- 23:24Automating feedback and metrics
- 24:53Summary
related talks
29mDSOMM Project
30mSecuring DevOps using OWASP DevSecOps Tools
33mIntroduction to OWASP SAMM for Software Developers: Building Secure Software
44mMaturing SDLC At A Fortune 500 Company Based On OWASP SAMM: Successes And Pitfalls
45mLeveraging Projects and Tools to Transform Your SDLC
51mThe End of DevSecOps?
36mOWASP SAMM 2 Your Dynamic Software Security Journey
44mProtecting Customers Through Smarter OSS Management