Assessment Worksheet
Applying OWASP to a Web Security Assessment
Course Name and Number: _____________________________________________________
Student Name: ________________________________________________________________
Instructor Name: ______________________________________________________________
Lab Due Date: ________________________________________________________________

Overview
In this lab, you explored the Open Web Application Security Project (OWASP) Web site and reviewed its Web application test methodology. You studied the standards and guides published by this project and summarized your findings. Finally, you drafted a Web Application Test Plan based on the information you gained in your OWASP research.

Lab Assessment Questions & Answers
1. Identify the four recognized business functions and each security practice of
OpenSAMM.
1) Governance
2) Construction
3) Verification
4) Deployment

2. Identify and describe the four maturity levels for security practices in SAMM.
1) Implicit starting point representing the activities in the Practice being unfulfilled
2) Initial understanding and ad hoc provision of Security Practice
3) Increase efficiency and/or effectiveness of the Security Practice
4) Comprehensive mastery of the Security Practice at scale

3. What are some activities an organization could perform for the security practice of Threat
Assessment?
Threat Assessment involves accurately identifying and characterizing potential attacks upon an organization’s software in order to better understand the risks and facilitate risk management.

4. What are the two recommended assessment styles for SAMM, and how are they used?
✦Lightweight - The assessment worksheets for each Practice are evaluated and scores are assigned based on answers
✦Detailed - After completion of the assessment worksheets, additional audit work is