OWASP DSOMM

Level 2: Adoption of basic security practices: Coverage of client side dynamic components
Risk:
Parts of the service are not covered during the scan, because JavaScript is not getting executed. Therefore, the co
Measure:
Usage of a spider which executes dynamic content like JavaScript, e.g. via Selenium.
Difficulty of Implementation:
Knowledge: High (two disciplines)
Time: High
Resources: Low
Usefulness:
Very High
Implementation:

Level 2: Adoption of basic security practices: Simple Scan
Risk:
Deficient security tests are performed. Simple vulnerabilities are not detected and missing security configurations (e.g. headers) are not set. Fast feedback is not given.
Measure:
A simple scan is performed to get a security baseline. In case the test is done in under 10 minutes, it should be part of the build and deployment process.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Low
Usefulness:
Low
Implementation:

Level 2: Adoption of basic security practices: Usage of different roles
Risk:
Parts of the service are not covered during the scan, because a login is not performed.
Measure:
Integration of authentication with all roles used in the service.
Difficulty of Implementation:
Knowledge: High (two disciplines)
Time: High
Resources: Low
Usefulness:
Medium
Assessment:
For REST APIs, multiple OAuth2 scopes are used.
Implementation:

Level 3: High adoption of security practices: Coverage of hidden endpoints
Risk:
Hidden endpoints of the service are not getting tracked.
Measure:
Hidden endpoints are getting detected and included in the vulnerability scan.
Difficulty of Implementation:
Knowledge: High (two disciplines)
Time: Medium
Resources: Low
Implementation:

Level 3: High adoption of security practices: Coverage of more input vectors
Risk:
Parts of the service are not covered. For example specially formatted or coded parameters are not getting detected as parameter (e.g. parameters in REST-like URLs, parameters in JSON-Format or base64-coded parameters).
Measure:
Special parameter and special encodings are defined, so that they get fuzzed by the used vulnerability scanners.
Difficulty of Implementation:
Knowledge:
Time:
Resources: Low
Usefulness:
Very High
Implementation:

Level 3: High adoption of security practices: Coverage of sequential operations
Risk:
Sequential operations like workflows (e.g. login -> put products in the basket
Measure:
Sequential operations are defined and checked by the vulnerability scanner in the defined order.
Difficulty of Implementation:
Knowledge: High (two disciplines)
Time: High
Resources: Low
Implementation:

Level 4: Very high adoption of security practices: Usage of multiple scanners
Risk:
Each vulnerability scanner has different opportunities. By using just one scanner, some vulnerabilities might not be found.
Measure:
Usage of multiple spiders and scanner enhance the coverage and the vulnerabilities.
Difficulty of Implementation:
Knowledge: High (two disciplines)
Time: High
Resources:
Usefulness:
Low
Implementation:

Level 5: Advanced deployment of security practices at scale: Coverage analysis
Risk:
Parts of the service are not still covered by tests.
Measure:
Check that there are no missing paths in the application with coverage-tools.
Difficulty of Implementation:
Knowledge: Very High (three or more disciplines)
Time:
Resources: High
Usefulness:
Very High
Implementation:

Level 5: Advanced deployment of security practices at scale: Coverage of service to service communication
Risk:
Service to service communication is not covered.
Measure:
Service to service communication is dumped and checked.
Difficulty of Implementation:
Knowledge: Very High (three or more disciplines)
Time:
Resources: Medium
Usefulness:
High