Assessment Worksheet
Applying OWASP to a Web Security Assessment
Web Security Management COM-545
Course Name and Number: _____________________________________________________
Plinio Alves
Student Name: ________________________________________________________________

Manh Nguyen
Instructor Name: ______________________________________________________________
10/30/15
Lab Due Date: ________________________________________________________________

Overview
In this lab, you explored the Open Web Application Security Project (OWASP) Web site and reviewed its Web application test methodology. You studied the standards and guides published by this project and summarized your findings. Finally, you drafted a Web Application Test Plan based on the information you gained in your OWASP research.

Lab Assessment Questions & Answers
1. Identify the four recognized business functions and each security practice of
OpenSAMM.
The four business function are governance, construction, verification and deployment.

2. Identify and describe the four maturity levels for security practices in SAMM.
Phase I: Awareness & Planning
Phase II: Education & Testing
Phase III: Architecture & Infrastructure
Phase IV: Governance & Operational Security

3. What are some activities an organization could perform for the security practice of Threat
Assessment?
Starting with simple threat models and building to more detailed methods of threat analysis and weighting, an organization improves over time. Ultimately, a sophisticated organization would maintain this information in a way that is tightly coupled to the compensating factors and pass-through risks from external entities.

4. What are the two recommended assessment styles for SAMM, and how are they used?
Business functions to ensure that business functionality is working and continuous. Security Practices
which