One of the leading security principles today is that you should embrace security practices throughout your entire Software Development Lifecycle (SDLC), from design to deployment and maintenance. This means that you, as a developer, have a crucial part to play in keeping your projects secure.

In my talk, I will show you how to do that by introducing you to the OWASP DevSecOps Maturity Model (DSOMM). This model, which is very accessible to anyone familiar with DevOps, allows you to evaluate and improve your security practices. As the model describes the entire Software Development Lifecycle, it also serves as a nice reference framework for industry-standard security practices.

I will start by giving you a high-level overview of the model and the principles behind it. I will also compare the DevSecOps Maturity Model with its older sibling, the OWASP Software Assurance Maturity Model (SAMM). Since it’s important, I will end the first part by going into the difference between having a good security culture and checkbox compliance.

Next, I will take you through the dimensions of the DevSecOps Maturity Model, with a focus on those dimensions that are especially relevant to developers. I will illustrate each dimension with concrete examples of security practices that you can implement yourself today.

Finally, I will talk about the best way to start implementing these practices. This is crucial: For instance, if you suddenly introduce all the tools you can find, chances are that the only thing you’ll learn from the plethora of alerts you’ll get is how to ignore these tools. Since some of us also have to deal with corporate policies and a limited sphere of influence within an organization, I will end with some pointers on how to advocate good security practices from the bottom up.

And, if this all feels a bit overwhelming, remember the big friendly letters in the title: Don’t Panic!