Куда я попал?
OWASP Devsecops Maturity Model
Framework
OWASP DSOMM (DevSecOps Maturity Model) это модель зрелости для интеграции практик безопасности в процессы DevSecOps. Это методология, с помощью которой можно оценить уровень зрелости конкретного процесса, реализованного в рамках безопасной разработки, выявить «подводные камни» и понять, как его можно улучшить.
Для проведения оценки соответствия по документу войдите в систему.
Для оценки соответствия
- авторизуйтесь
- авторизуйтесь
Планируемый уровень
Текущий уровень
Группы областей
67
%
Входящая логистика
85
%
Создание продукта
35
%
Исходящая логистика
73
%
Маркетинг, продажа
69
%
Обслуживание клиента
78
%
Инфраструктура
48
%
HR-менеджмент
55
%
Технологии
49
%
Закупки / Снабжение
46
%
Опыт клиента
Список требований
-
Level 4: Very high adoption of security practices: .gitignore
Risk:
Unintended leakage of secrets, debug, or workstation specific data
Measure:
.gitignore files help prevent accidental commits of secrets, debug, or workstation specific data
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Low
Resources: LowОбязательно для уровня зрелости 1 2 3 4 -
Level 5: Advanced deployment of security practices at scale: Microservice-architecture
Risk:
Monolithic applications are hard to test.
Measure:
A microservice-architecture helps to have small components, which are more easy to test.
Difficulty of Implementation:
Knowledge: Very High (three or more disciplines)
Time:
Resources:
Usefulness:
LowОбязательно для уровня зрелости 1 2 3 4 5 -
Level 2: Adoption of basic security practices: Visualized metrics
Risk:
Not visualized metrics lead to restricted usage of metrics.
Measure:
Metrics are visualized in real time in a user friendly way.
Difficulty of Implementation:
Knowledge: Low (one discipline)
Time: Medium
Resources: Medium
Usefulness:
HighОбязательно для уровня зрелости 1 2 -
Level 3: High adoption of security practices: Deactivation of unused metrics
Risk:
High resources are used while gathering unused metrics.
Measure:
Deactivation of unused metrics helps to free resources.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time:
Resources:Обязательно для уровня зрелости 1 2 3 -
Level 3: High adoption of security practices: Grouping of metrics
Risk:
The analysis of metrics takes long.
Measure:
Meaningful grouping of metrics helps to speed up analysis.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Very High
Resources: Medium
Usefulness:
MediumОбязательно для уровня зрелости 1 2 3 -
Level 4: Very high adoption of security practices: Screens with metric visualization
Risk:
Security related information is discovered too late during an incident.
Measure:
By having an internal accessible screen with a security related dashboards helps to visualize incidents.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Low
Resources: LowОбязательно для уровня зрелости 1 2 3 4 -
Level 5: Advanced deployment of security practices at scale: Metrics are combined with tests
Risk:
Changes might cause high load due to programming errors.
Measure:
Metrics during tests helps to identify programming errors.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: High
Resources: MediumОбязательно для уровня зрелости 1 2 3 4 5 -
Level 3: High adoption of security practices: Treatment of defects with severity middle
Risk:
Vulnerabilities with severity middle are not visible.
Measure:
Vulnerabilities with severity middle are added to the quality gate.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Low
Usefulness:HighОбязательно для уровня зрелости 1 2 3 -
Level 5: Advanced deployment of security practices at scale: Treatment of all defects
Risk:
Vulnerabilities with severity low are not visible.
Measure:
All vulnerabilities are added to the quality gate.
Difficulty of Implementation:
Knowledge: High (two disciplines)
Time: Very High
Resources: Low
Usefulness:
MediumОбязательно для уровня зрелости 1 2 3 4 5 -
Level 5: Advanced deployment of security practices at scale: Coverage of service to service communication
Risk:
Service to service communication is not covered.
Measure:
Service to service communication is dumped and checked.
Difficulty of Implementation:
Knowledge: Very High (three or more disciplines)
Time:
Resources: Medium
Usefulness:
HighОбязательно для уровня зрелости 2 3 4 5 -
Level 3: High adoption of security practices: Analyze logs
Risk:
Not aware of attacks happening.
Measure:
Check logs for keywords.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Medium
Usefulness:
High
Implementation:- SigmaHQ
- Tags
- URL
- https://github.com/SigmaHQ/sigma
- Description
- Tags
Обязательно для уровня зрелости 1 2 3 - SigmaHQ
-
Level 3: High adoption of security practices: Test for new image version
Risk:
When a new version of an image is available, it might fix security vulnerabilities.
Measure:
Check for new images of containers in production.
Difficulty of Implementation:
Knowledge: High (two disciplines)
Time: High
Resources: Low
Usefulness:
MediumОбязательно для уровня зрелости 1 2 3
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.