Mapping SAMM to Security Automation


The presentation by Richard Struse (US Department of Homeland Security) and Steve Christey (Mitre) of Risk Analysis and Measurement with CWRAF (PDF) at the IT Security Automation Conference in October 2011 illustrates how software security automation enumerations and protocols map to SAMM’s construction, verification and deployment security practices. The specifications highlighted in the presentation’s final slide are:

I have summarised the slide in the table below.

For further security registries, description languages and standardised processes see the Making Security Measurable website. Risk Analysis and Measurement with CWRAF is being presented at AppSec DC 2012 in April.

, ,

  1. #1 by ak - March 27th, 2012 at 10:06

    Has any one implemented (considered) automation of CWE/CWSS in SCAP manner. The above slide gives an impression that OVAL does not support CWE, but is that not extisible?
    Regards.

(will not be published)

  1. No trackbacks yet.