WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Feb 1, 2022

Maturity assessment for technicians or how I learned to love OWASP SAMM

Mathias Tausig

Are you still waiting for late-stage penetration tests to catch critical vulnerabilities? Discover how OWASP SAMM empowers developers to shift security left directly into the IDE.

Pause
Mute Enter Fullscreen
#1 about 6 min

Introduction to secure development and OWASP SAMM

Why focusing purely on secure coding is insufficient without a comprehensive secure development lifecycle.

#2 about 5 min

Common consequences of secure development lifecycle failures

How undefined responsibilities and missing threat models lead to expensive production vulnerabilities.

#3 about 6 min

Exploring the structure of the OWASP SAMM framework

The core business functions, security practices, streams, and maturity levels that make up SAMM.

#4 about 4 min

Mapping production vulnerabilities to OWASP SAMM domains

Finding the root cause of component vulnerabilities and missing designs within specific assessment streams.

#5 about 4 min

Generating granular scores and creating improvement roadmaps

Using assessment results to identify organizational blind spots rather than fixating on absolute metrics.

#6 about 10 min

Conducting an effective SAMM interview and self-assessment

The logistics of setting up external interviews, guided self-assessments, and utilizing the provided spreadsheet toolbox.

#7 about 6 min

Common pitfalls to avoid during maturity assessments

Why organizations should refrain from comparing teams directly and instead focus on application-specific contexts.

#8 about 6 min

Audience Q&A on maturity assessments and external consultants

Audience questions around team size requirements and mitigating bias during internal security assessments.

#9 about 7 min

Embracing DevSecOps and automating the software development lifecycle

Shifting security left by integrating early automated feedback across code, containers, and infrastructure.

#10 about 5 min

Analyzing risks in open source and transitive dependencies

Understanding how the scale of nested project dependencies expands the vulnerable surface area of applications.

#11 about 10 min

Demonstrating a cross-site scripting attack on vulnerable inputs

Bypassing a markdown library's basic sanitization logic to execute a malicious payload.

#12 about 10 min

Fixer automation and in-editor software composition analysis

How developer-focused tools integrate directly into the IDE to detect and remediate vulnerabilities instantly.

#13 about 7 min

Integrating SAST and container security into developer workflows

Scanning proprietary code logic and base container images to block vulnerabilities before entering production.

#14 about 5 min

Securing environments by scanning infrastructure as code

Preventing exploitation by continuously monitoring configuration files and tracking infrastructure drift over time.

#15 about 6 min

Using financial data to advocate for security integration

Convincing technical leadership that fixing vulnerabilities early is exponentially cheaper than managing production breaches.

#16 about 13 min

Q&A on security automation and building champions programs

Final questions covering vulnerability capability, log4j tracking, and cultivating an organic security culture.

Matching moments

13:13 min

Answering audience questions on practical application security

Thomas Konrad · World Congress 2021

1:53 min

Transitioning toward DevSecOps with dynamic scanning and secrets management

Christoph Ruggenthaler · LIVE

5:25 min

Shifting left and creating internal security champion programs

Vandana Verma Sehgal · LIVE

5:30 min

Identifying non-coding software vulnerabilities and organizational risks

Tino Sokic · World Congress 2023

26:47 min

Exploring pathways to application security careers and research workflows

Vandana Verma Sehgal · LIVE

2:33 min

Introduction to security advocacy and automation testing

Chris Heilmann +2 · LIVE

More from WeAreDevelopers LIVE

WeAreDevelopers LIVE - Is CSS Catching Up to Flash? thumbnail
1:03:33
6 days ago

WeAreDevelopers LIVE - Is CSS Catching Up to Flash?

Chris Heilmann, Daniel Cranney, Bramus Van Damme

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail
1:21:17
14 days ago

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof Cieślak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail
4:23
15 days ago

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Open Source Agent Toolkits thumbnail
1:00:38
20 days ago

WeAreDevelopers LIVE - Open Source Agent Toolkits

Chris Heilmann, Daniel Cranney, Eddie Jaoude

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail
6:16
22 days ago

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail
5:46
27 days ago

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 15:00–17:00

Stage 12

Secure development from pull request to production with GitHub

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen
Open session

World Congress 2026 North America

September 24, 2026 · 16:00–18:00

Stage 13

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed
Open session

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 10

Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security

Ajeet Raina

Developer Advocate at Docker

Ajeet Raina
Open session

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 5

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

September 24, 2026 · 14:50–15:20

Stage 1

The Era of Machine-Driven Defense is Here: Headless Security

Loris Degioanni

Founder & CTO of Sysdig

Loris Degioanni
Open session

World Congress 2026 North America

September 23, 2026 · 14:00–14:30

Stage 1

Supply Chain Security When Agents Write the Code

Ajeet Raina

Developer Advocate at Docker

Ajeet Raina

Related videos

Software Security 101: Secure Coding Basics thumbnail
1:58:48
World Congress 2021 • about 5 years ago

Software Security 101: Secure Coding Basics

Thomas Konrad

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together thumbnail
23:34
World Congress 2022 • over 4 years ago

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together

Stefania Chaplin

Securing Your Web Application Pipeline From Intruders thumbnail
44:30
LIVE • almost 6 years ago

Securing Your Web Application Pipeline From Intruders

Milecia Mcgregor

Security Pitfalls for Software Engineers thumbnail
27:32
World Congress 2023 • almost 3 years ago

Security Pitfalls for Software Engineers

Jasmin Azemović

Simple Steps to Kill DevSec without Giving Up on Security thumbnail
21:53
World Congress 2025 • about 1 year ago

Simple Steps to Kill DevSec without Giving Up on Security

Isaac Evans

Why Security-First Development Helps You Ship Better Software Faster thumbnail
22:18
World Congress 2025 • about 1 year ago

Why Security-First Development Helps You Ship Better Software Faster

Michael Wildpaner

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.