Hands-On Security in DevOps

Security Assurance Program and Organization

This chapter will discuss security assurance programs such as Security Development Lifecycle (SDL), OWASP Software Assurance Maturity Model (SAMM), and ISO 27001. Then, we will talk about how security may develop with business growth. Furthermore, there are non-technical parts that matter to the success of any security program, such as the processes, guidelines, training, and roles. A small case study will be discussed to explain how different organization structures may impact the execution of a security assurance program.

The topics to be covered in this chapter are as follows:

• Security assurance programs
• Security growth with business
• Role of a security team in an organization
• Case study—a matrix, ...