OWASP DSOMM

Level 1: Basic understanding of security practices: App. Hardening Level 1 (50%)
Description:
To tackle the security of code developed in-house, OWASP offers an extensive collection of Cheatsheets demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jumpstart the development process, but also do so securely.
[...]
The Requirements gathering process tries to answer the question: "What is the system going to do?" At this stage, the SAMM project offers 3 distinct maturity levels covering both in-house software development and third party supplier security.
Organizations can use these to add solid security considerations at the start of the Software Development or Procurement process.
These general security considerations can be audited by using a subsection of the ASVS controls in section V1 as a questionnaire. This process attempts to ensure that every feature has concrete security considerations.
In case of internal development and if the organization maps Features to Epics, the Security Knowledge Framework can be used to facilitate this process by leveraging its questionnaire function, shown below.
Source: OWASP Project Integration
Risk:
Using an insecure application might lead to a compromised application. This might lead to total data theft or data modification.
Measure:
Following frameworks like the

in all applications provides a good baseline. Implement 50% of the recommendations.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Low
Usefulness:
High
Implementation:

Level 1: Basic understanding of security practices: Contextualized Encoding
Description:
Bear in mind that utilizing frameworks is a recommended approach; however, they can develop known security weaknesses over time. Diligent and regular patching is crucial.
Risk:
The generation of interpreter directives from user-provided data poses difficulties and can introduce vulnerabilities to injection attacks.
Measure:
Implementing contextualized encoding, such as employing object-relational mapping tools or utilizing prepared statements, nearly removes the threat of injection vulnerabilities.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Low
Usefulness:
High

Level 2: Adoption of basic security practices: App. Hardening Level 1
Description:
To tackle the security of code developed in-house, OWASP offers an extensive collection of Cheatsheets demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jump-start the development process, but also do so securely.
[...]
The Requirements gathering process tries to answer the question: "What is the system going to do?" At this stage, the SAMM project offers 3 distinct maturity levels covering both in-house software development and third party supplier security.
Organizations can use these to add solid security considerations at the start of the Software Development or Procurement process.
These general security considerations can be audited by using a subsection of the ASVS controls in section V1 as a questionnaire. This process attempts to ensure that every feature has concrete security considerations.

In case of internal development and if the organization maps Features to Epics, the Security Knowledge Framework can be used to facilitate this process by leveraging its questionnaire function, shown below.
Source: OWASP Project Integration
Risk:
Using an insecure application might lead to a compromised application. This might lead to total data theft or data modification.
Measure:
Following frameworks like the

in all applications provides a good baseline. Implement 95%-100% of the recommendations.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Low
Usefulness:
Very High
Implementation:

Level 3: High adoption of security practices: App. Hardening Level 2 (75%)
Risk:
Using an insecure application might lead to a compromised application. This might lead to total data theft or data modification.
Measure:
Following frameworks like the

Implement 75% of the recommendations.
Difficulty of Implementation:
Knowledge: High (two disciplines)
Time: High
Resources: Low
Usefulness:
High
Implementation:

Level 4: Very high adoption of security practices: App. Hardening Level 2
Risk:
Using an insecure application might lead to a compromised application. This might lead to total data theft or data modification.
Measure:
Following frameworks like the

Implement 95%-100% of the recommendations.
Difficulty of Implementation:
Knowledge: High (two disciplines)
Time: High
Resources: Low
Usefulness:
High
Implementation:

Level 5: Advanced deployment of security practices at scale: App. Hardening Level 3
Risk:
Using an insecure application might lead to a compromised application. This might lead to total data theft or data modification.
Measure:
Following frameworks like the

Implement 95%-100% of the recommendations.
Difficulty of Implementation:
Knowledge: Very High (three or more disciplines)
Time: Very High
Resources: Medium
Usefulness:
Very High
Implementation: