WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:0

00:06.320 --> 00:15.200
The
Open Web application security project, or

00:15.230 --> 00:19.700
OAS, an organization focused on
improving the security of software.

00:19.720 --> 00:21.480
Their mission is to make software security

00:21.510 --> 00:25.300
visible so that individuals and
organizations can make informed decisions.

00:25.330 --> 00:27.580
Oas has been around for years.

00:27.600 --> 00:31.620
Oas puts out top 10 lists of application

00:31.650 --> 00:35.540
security threats, and mobile security
threats, and IoT security threats.

00:35.570 --> 00:36.740
Great resource.

00:36.770 --> 00:41.540
Lots and lots of information on
various types of application attacks.

00:41.560 --> 00:45.680
They also put out some tools like OAS ZAP,
which you are going to play with a little

00:45.710 --> 00:48.960
bit in the lab, and
Durabuster and a few others.

00:50.800 --> 00:54.980
Software security, software
assurance maturity model.

00:55.010 --> 00:57.380
We've talked about maturity models.

00:57.410 --> 01:00.620
We know that maturity models deal with the

01:00.640 --> 01:03.500
process, governance, construction,
verification, and deployment,

01:03.530 --> 01:06.930
and the various stages of
the development process.

01:06.960 --> 01:08.680
We're not going to pick this
one apart too much here.

01:08.710 --> 01:11.770
We've definitely got a
feel for maturity models.

01:11.800 --> 01:14.560
The main objective of building security

01:14.560 --> 01:17.240
and maturity model
is to enable the organization to analyze

01:17.240 --> 01:20.520
and implement security features it
requires by evaluating those frequently

01:20.550 --> 01:23.680
implemented security
features in other companies.

01:23.680 --> 01:26.210
Again, that goes into software
development frameworks.

01:26.240 --> 01:29.850
Again, this is a
framework for best practices.

01:29.880 --> 01:32.200
Well, twelve practices
organized in four demands.