Building a DevSecOps programme: maturity, metrics and champions
You measure an organisation’s secure development maturity, draw up a roadmap, build a security champions network and report progress to leadership with clear metrics.
Level 501 · 14 lessons · 12 practice labs
Lessons
Maturity
- Maturity models: OWASP SAMM and BSIMM
- Assessing the current state with SAMM
- Target state and roadmap
- Short task: score a sample company with SAMM
People
- A security champions network
- Developer training: when and how much
- Security agreements and shared responsibility with teams
- Short task: design a champions programme for six teams
Policy and metrics
- Organisation-wide policy as code
- Metrics: time to fix, coverage, vulnerability density
- Reducing tool sprawl
- Reporting to leadership: speaking in terms of risk
- Short task: draft a quarterly DevSecOps dashboard
Capstone
- Capstone: a two-year DevSecOps plan for a mid-sized software company
Practice labs
- Match SAMM business functions to activities: Place ten activities under governance, design, implementation, verification and operations.
- Score a sample company with SAMM: Determine each practice’s level from the interview notes and produce the score table.
- Derive the target state and roadmap: Set target scores a year out for Kuzeyyıldızı Kargo, spread the gap over four quarters and explain why not every area goes to the top level.
- Define a security champion’s duties: Write what the role does, what it does not and the weekly time it takes.
- Design a champions programme for six teams: Set the selection criteria, training content, meeting rhythm and success measure.
- Prepare a security agreement and training plan with teams: Write an agreement covering fix deadlines and shared responsibilities, plan training by role and timing and state how you will measure its effect.
- Classify metrics by what they show: Mark eight metrics as activity, coverage or outcome measures.
- Draft a quarterly DevSecOps dashboard: Write the data source, calculation and target for time to fix, scan coverage and vulnerability density.
- Write a plan that reduces tool sprawl and enforces policy as code: Compare twelve tools by function, cost and usage, choose which to retire and describe three organisation-wide policies as code.
- Rewrite a technical finding in terms of risk: Turn three findings into sentences a manager understands using business impact, likelihood and cost.
- Prepare the quarterly report for leadership: Present the trends, the three biggest risks and the decision you need on one page.
- Write a two-year DevSecOps plan for a mid-sized software company: Prepare a plan with maturity targets, people and tooling investment, metrics and quarterly milestones, and add the budget justification.
About this course
You measure an organisation’s secure development maturity, draw up a roadmap, build a security champions network and report progress to leadership with clear metrics.
What you will learn
- Maturity
- People
- Policy and metrics
- Capstone
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.