DSOMM from Theory to Enforcement

The talk introduces the OWASP DevSecOps Maturity Model (DSOMM) and argues that maturity models help translate security goals into terms leadership can act on. It begins by comparing common frameworks, including NIST's cybersecurity framework, Cloud Security Alliance guidance and OWASP SAMM, before explaining how DSOMM is organised into dimensions, sub-dimensions and up to four maturity levels, many of which borrow from SAMM.

The middle of the talk works through the model's sub-dimensions in turn: application hardening, source control, infrastructure hardening, application testing, consolidation of results, and dynamic and static analysis. For each, the speaker maps the security requirements to concrete open source tools, such as language-specific code scanners, dependency checkers, secret detection, infrastructure-as-code scanning and OWASP ZAP for dynamic testing. Supplier security and some infrastructure controls are presented as more manual work.

The closing part covers the challenge of handling large volumes of findings and describes running checks per pull request so teams can decide what should block a merge. The speaker suggests starting with the early maturity levels and using the model as a roadmap, while noting that the tool choices reflect one cloud-native startup's stack.