OWASP DSOMM

Level 1: Basic understanding of security practices: Fix based on severity
Risk:
Overwhelming volume of security findings from automated testing tools. This might lead to ignorance of findings.
Measure:
Implement a very simple risk-based prioritization framework for vulnerability remediation based on the severity of the findings.
On level one, fix only critical findings.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Low
Usefulness:
High

Level 1: Basic understanding of security practices: Simple false positive treatment
Risk:
As false positive occur during each test, all vulnerabilities might be ignored.
Measure:
False positives are suppressed so they will not show up on the next tests again. Most security tools have the possibility to suppress false positives. A Vulnerability Management System might be used.
Difficulty of Implementation:
Knowledge: Low (one discipline)
Time: Low
Resources: Low
Usefulness:
Very High
Implementation:

Level 1: Basic understanding of security practices: Treatment of defects with severity high or higher
Risk:
Vulnerabilities with severity high or higher are not visible.
Measure:
Vulnerabilities with severity high or higher are added to the quality gate.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Low
Usefulness:
Very High

Level 2: Adoption of basic security practices: Simple visualization of defects
Risk:
The security level of a component is not visible. Therefore, the motivation to enhance the security is not give.
Measure:
Vulnerabilities are simple visualized.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Low
Usefulness:
High
Implementation:

Level 3: High adoption of security practices: Fix based on accessibility
Risk:
Overwhelming volume of security findings from automated testing tools. This might lead to ignorance of findings.
Measure:
Implement a simple risk-based prioritization framework for vulnerability remediation based on accessibility of the applications.
Implementation Guide:
Develop a scoring system for asset accessibility, considering factors like:

Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Low
Usefulness:
Very High

Level 3: High adoption of security practices: Integration in development process
Description:
Validating Findings by Security Engineers Pros:

Validating Findings by Security Engineers Cons:

Pushing Findings Directly to Product Teams Pros:

Risk:
Not integrating vulnerability handling into the development process may result in product teams ignoring findings.
Security joke: We will gain 100% false negatives.
Measure:
Integration of findings into the development process. E.g. adding findings to the backlog of products teams
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Medium
Usefulness:
High
Implementation:

Level 3: High adoption of security practices: Integration of vulnerability issues into the development process
Risk:
To read console output of the build server to search for vulnerabilities might be difficult. Also, to check a vulnerability management system might not be a daily task for a developer.
Measure:
Vulnerabilities are tracked in the teams issue system (e.g. jira).
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Low
Usefulness:
Medium
Implementation:

Level 3: High adoption of security practices: Treatment of defects per protection requirement
Description:
Validating Findings by Security Engineers Pros:

Validating Findings by Security Engineers Cons:

Pushing Findings Directly to Product Teams Pros:

Risk:
Not integrating vulnerability handling into the development process may result in product teams ignoring findings.
Security joke: We will gain 100% false negatives.
Measure:
Integration of findings into the development process. E.g. adding findings to the backlog of products teams
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Medium
Usefulness:
High
Implementation:

Level 3: High adoption of security practices: Treatment of defects with severity middle
Risk:
Vulnerabilities with severity middle are not visible.
Measure:
Vulnerabilities with severity middle are added to the quality gate.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Low
Usefulness:

High

Level 3: High adoption of security practices: Usage of a vulnerability management system
Description:
For known vulnerabilities a processes to estimate the exploit ability of a vulnerability is recommended.
To implement a security culture including training, office hours and security champions can help integrating
security scanning at scale. Such activities help to understand why a vulnerability is potentially critical and needs handling.
Risk:
Maintenance of false positives in each tool enforces a high workload. In addition a correlation of the same finding from different tools is not possible.
Measure:
Aggregation of vulnerabilities in one tool reduce the workload to handle them, e.g. mark as false positives.
Difficulty of Implementation:
Knowledge: High (two disciplines)
Time: High
Resources: Medium
Usefulness:
Medium
Implementation:

Level 4: Very high adoption of security practices: Advanced visualization of defects
Risk:
Correlation of the vulnerabilities of different tools to have an overview of the the overall security level per component/project/team is not given.
Measure:
Findings are visualized per component/project/team.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Very High
Resources: Low
Usefulness:
Medium
Implementation:

Level 4: Very high adoption of security practices: Reproducible defect tickets
Risk:
Vulnerability descriptions are hard to understand by staff from operations and development.
Measure:
Vulnerabilities include the test procedure to give the staff from operations and development the ability to reproduce vulnerabilities. This enhances the understanding of vulnerabilities and therefore the fix have a higher quality.
Difficulty of Implementation:
Knowledge: High (two disciplines)
Time: Medium
Resources: Medium
Usefulness:
Medium

Level 5: Advanced deployment of security practices at scale: Treatment of all defects
Risk:
Vulnerabilities with severity low are not visible.
Measure:
All vulnerabilities are added to the quality gate.
Difficulty of Implementation:
Knowledge: High (two disciplines)
Time: Very High
Resources: Low
Usefulness:
Medium