Information Security Blog

“Play it again, SAMM”

web application security

Fair warning — this blog takes place from the top of my soap-box, so continue at your own risk!

We all know that application security, especially web application security is real complex, and can only be addressed by equally complex technical solutions like web application firewalls, virtual system patching, … NOT ….

Having been involved in one too many breach incident responses the last few weeks, I’m increasingly convinced that my belief that complex challenges demand simple responses is the right path. My challenge is convincing others .. so it’s up onto the soap-box. As a pure assessment firm we often end up leveraging root cause analysis post incident. Invariably, the perceived root cause “we were vulnerable to SQL injection” is actually the symptom of much more fundamental causes: “we failed to conduct proper tests before deploying”, “our developers were not sufficiently knowledgeable of web application attacks”, “we failed to understand the risks to the application”, etc.

Raise your hand if you have an SDLC. Not too bad, now; keep it up only if your SDLC:

Is current (has been updated within the last year,
Includes security touch-points throughout the life-cycle,
Includes OWASP Top 10 touch points for management, developers, & testers,
Is enforced by an IT Steering Committee (or equivalent) and includes milestones for key phases.

I could add another ten bullets … but being everyone’s hand is down by now … I think you get my point.

The good news is that there is some new and very well done guidance on integrating security into the SDLC. OWASP’s Software Assurance Maturity Model (SAMM) is a terrific new resource. Rather than define SAMM … I’ll steal the high level description from OWASP’s site:

The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. The resources provided by SAMM will aid in:
• Evaluating an organization’s existing software security practices
• Building a balanced software security assurance program in well-defined iterations
• Demonstrating concrete improvements to a security assurance program
• Defining and measuring security-related activities throughout an organization

One of the things I like best about SAMM is that it was targeted at non-security personnel and non-application developers which means that it can be governed by normal business folk. SAMM helps make an S-SDLC a simple solution to a complex problem.

Remember simple ≠ simplistic … (time to climb off the soap-box and get a new cup of coffee!)

We have an on-demand webinar that talks to this specific issue, SAMM, and OWASP as a whole that I recommend you look at if this blog piqued your interest.