Application security at scale: programme, automation and variant analysis
You measure an organisation’s application security programme with OWASP SAMM, spread it through security champions and secure defaults, combine SAST, DAST and SCA in one pipeline, and find a flaw’s whole family with variant analysis.
Level 501 · 15 lessons · 13 practice labs
Lessons
The programme
- An AppSec programme: security in the software development lifecycle and maturity with OWASP SAMM
- Building a security champions network
- Secure defaults and the paved road: libraries and templates
- Short task: carry out a SAMM self-assessment for the lab company
Automation
- Combining SAST, DAST and SCA in one pipeline
- Findings management: merging, priority and SLAs
- SBOMs and software supply-chain security
- Short task: merge the results of three scanners into one dashboard
Variant analysis
- Variant analysis: from one flaw to its whole family
- Hunting variants across the codebase with CodeQL
- An organisation-wide Semgrep rule set and its upkeep
- Short task: find every variant of a flaw found after an incident
Measuring and reporting
- Metrics: time to fix, escape rate and coverage
- Reporting risk to leadership
- Capstone: build an AppSec roadmap and automation for a 20-repository organisation
Practice labs
- A SAMM self-assessment: Score maturity in three SAMM areas from the lab company's practices and write the evidence.
- A paved road: a secure template repo: Prepare a template repo with secure defaults for new services and move one service onto it.
- A role description for security champions: Define champion duties, training and measures per team in the twenty-repo lab organisation.
- A shared authorisation library: Gather the authorisation checks teams wrote separately into one library and roll it out in two repos.
- Run three scanners in one pipeline: Run SAST, SCA and DAST steps in one pipeline in a repo and send the results to the dashboard.
- Merge and deduplicate findings: Deduplicate findings from three scanners in the dashboard and gather the same root cause into one record.
- SLA and priority rules: Define fix-time rules by severity and asset criticality and report overdue findings.
- Produce an SBOM and find the affected repos: Produce SBOMs for the repos and list within minutes those affected by a newly announced flaw.
- The time-to-fix metric: Calculate mean time to fix and its spread by severity from the findings dashboard.
- From one flaw to its family: a variant search: Search twenty repos for the pattern of a flaw found in an incident and list the places with the same mistake.
- Variant analysis with CodeQL: Turn the data flow of the found flaw into a CodeQL query, run it on every repo and verify the results.
- An organisation-specific Semgrep rule set: Write three rules specific to the organisation's own framework, add test samples and define the maintenance process.
- A risk report for management: Prepare a one-page risk summary and a one-quarter roadmap for management from the metrics.
About this course
You measure an organisation’s application security programme with OWASP SAMM, spread it through security champions and secure defaults, combine SAST, DAST and SCA in one pipeline, and find a flaw’s whole family with variant analysis.
What you will learn
- The programme
- Automation
- Variant analysis
- Measuring and reporting
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.