The end goal of security for any organization is to secure customer digital assets. The goal we are going to discuss here is how to define organization-level phased goals for security assurance programs and DevSecOps.
The Open Web Application Security Project (OWASP) and Software Assurance Maturity Model (SAMM) governance define three key areas when considering an organization security goal:
- Strategy and metrics: Establishes the framework for a software security assurance program
- Policy and compliance: Focused on ensuring external legal or regulatory compliance (such as GDPR or ISO 27001) is met
- Education and guidance: This is for security awareness training and role-specific security capabilities in order to perform DevOps ...
