|
| 1 | +# Install DSOMM |
| 2 | +The DSOMM application is frontend only. Data is only stored in server side YAML files, and in the localStorage im the user's browser. |
| 3 | + |
| 4 | +The application can be deployed in many ways. using a number of Docker, Amazon AWS and a standalone Angular service. |
| 5 | + |
| 6 | +## Get the Activities |
| 7 | + |
| 8 | +The _DSOMM activities_ are maintained in a separate GitHub repository. For the latest version, get it from: |
| 9 | +- https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data |
| 10 | + |
| 11 | + |
| 12 | +## Docker |
| 13 | +1. Install [Docker](https://www.docker.com) |
| 14 | +1. Download and run DSOMM: \ |
| 15 | + `docker pull wurstbrot/dsomm:latest` \ |
| 16 | + `docker run --rm -p 8080:8080 wurstbrot/dsomm:latest` |
| 17 | +1. Open DSOMM on http://localhost:8080 |
| 18 | + - If you are using docker-machine instead of the native docker installation on Windows or macOs: open <http://192.168.99.100:8080> instead |
| 19 | +If you want to override the default `generated.yaml` you can mount this file when starting the docker command. |
| 20 | + |
| 21 | +`docker run --rm --volume $PWD/generated.yaml:/srv/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm` |
| 22 | + |
| 23 | +**NB!** Note that the docker command requires an absolute path to the local file. (Hence, the use of the `$PWD` variable. On Windows, substitute `$PWD` with `%CD%`.) |
| 24 | + |
| 25 | + |
| 26 | +## Amazon EC2 Instance |
| 27 | + |
| 28 | +1. In the _EC2_ sidenav select _Instances_ and click _Launch Instance_ |
| 29 | +2. In _Step 1: Choose an Amazon Machine Image (AMI)_ choose an _Amazon |
| 30 | + Linux AMI_ or _Amazon Linux 2 AMI_ |
| 31 | +3. In _Step 3: Configure Instance Details_ unfold _Advanced Details_ and |
| 32 | + copy the script below into _User Data_ |
| 33 | +4. In _Step 6: Configure Security Group_ add a _Rule_ that opens port 80 |
| 34 | + for HTTP |
| 35 | +5. Launch your instance |
| 36 | +6. Browse to your instance's public DNS |
| 37 | + |
| 38 | +```bash |
| 39 | +#!/bin/bash |
| 40 | +service docker start |
| 41 | +docker run -d -p 80:8080 wurstbrot/dsomm:latest |
| 42 | +``` |
| 43 | + |
| 44 | + |
| 45 | +## Any web server - Angular build |
| 46 | +Since DSOMM is a frontend only application, any web server can host DSOMM. |
| 47 | +- Clone the DSOMM repo |
| 48 | + |
| 49 | +- **NB!** The DSOMM activities are maintained separately. Download the `generated.yaml` and put it in the required folder |
| 50 | +``` |
| 51 | +git clone https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel.git |
| 52 | +cd DevSecOps-MaturityModel |
| 53 | +npm install |
| 54 | +curl https://raw.githubusercontent.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/main/src/assets/YAML/generated/generated.yaml -o src/assets/YAML/generated/generated.yaml |
| 55 | +ng build |
| 56 | +``` |
| 57 | +The files that were created in the subfolder `dist` |
| 58 | + |
| 59 | +If your DSOMM application is having a subfolder in the URL (e.g. https://server.local/our-dsomm), you need to build the Angular application to prepare for this. In that case build the application by using `ng build --base-href /our-dsomm/`. |
| 60 | + |
| 61 | + |
| 62 | +## Teams and Groups |
| 63 | +To customize these teams, you can create your own [meta.yaml](src/assets/meta.yaml) file with your unique team definitions. |
| 64 | + |
| 65 | +Assessments within the framework can be based on either a team or a specific application, which can be referred to as the context. Depending on how you define the context or teams, you may want to group them together. |
| 66 | + |
| 67 | +Here are a couple of examples to illustrate this, in breakers the DSOMM word: |
| 68 | +- Multiple applications (teams) can belong to a single overarching team (application). |
| 69 | +- Multiple teams (teams) can belong to a larger department (group). |
| 70 | + |
| 71 | +Feel free to create your own [meta.yaml](src/assets/meta.yaml) file to tailor the framework to your specific needs and mount it in your environment (e.g. kubernetes or docker). |
| 72 | +Here is an example to start docker with customized meta.yaml: |
| 73 | +``` |
| 74 | +# Customized meta.yaml |
| 75 | +cp src/assets/YAML/meta.yaml . |
| 76 | +docker run -v $(pwd)/meta.yaml:/srv/assets/YAML/meta.yaml -p 8080:8080 wurstbrot/dsomm |
| 77 | +
|
| 78 | +# Customized meta.yaml and generated.yaml |
| 79 | +cp src/assets/YAML/meta.yaml . |
| 80 | +cp $(pwd)/src/assets/YAML/generated/generated.yaml . |
| 81 | +docker run -v $(pwd)/meta.yaml:/srv/assets/YAML/meta.yaml -v $(pwd)/generated.yaml:/srv/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm |
| 82 | +``` |
| 83 | + |
| 84 | +In the corresponding [dimension YAMLs](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/tree/main/src/assets/YAML/default), use: |
| 85 | +``` |
| 86 | +[...] |
| 87 | + teamsImplemented: |
| 88 | + Default: false |
| 89 | + B: true |
| 90 | + C: true |
| 91 | + teamsEvidence: |
| 92 | + B: All team members completed OWASP Secure Coding Dojo training on 2025-01-11. |
| 93 | + C: | |
| 94 | + The pentest report from 2025 has been split into Jira tasks under |
| 95 | + [TODO-123](https://jira.example.com/issues/TODO-123). |
| 96 | + |
| 97 | + _2025-04-01:_ All fixes of **critical** findings are deployed to production. |
| 98 | +``` |
| 99 | +The `|` is yaml syntax to indicate that the evidence spans multiple lines. Markdown |
| 100 | +syntax can be used. The evidence is currently visible on the activity from the Matrix page. |
| 101 | + |
| 102 | +# Back link |
| 103 | + |
| 104 | +- [OWASP DevSecOps maturity model page](https://dsomm.owasp.org/) |
| 105 | +- [OWASP DevSecOps project page](https://owasp.org/www-project-devsecops-maturity-model/) |
| 106 | +- [OWASP](https://owasp.org) |
| 107 | + |
| 108 | +# Your help is needed to perform |
| 109 | + |
| 110 | +* Adding a manual on how to use DSOMM |
| 111 | +* Integration of Incident Response |
| 112 | +* DevSecOps Toolchain Categorization |
| 113 | +* App Sec Maturity Models Mapping |
| 114 | +* CAMS Categorization |
| 115 | +* Adding assessment questions |
| 116 | + |
| 117 | +# Multi-language support |
| 118 | +Multi-language support is not currently planned. |
| 119 | + |
| 120 | +# Sponsors |
| 121 | + |
| 122 | +[](https://pagel.pro) |
| 123 | + |
| 124 | +[](https://apiiro.com/) |
| 125 | + |
| 126 | +[](https://www.heroku.com/open-source-credit-program) |
| 127 | + |
| 128 | +# Donations |
| 129 | + |
| 130 | +If you are using the model or you are inspired by it, want to help but don't want to create pull requests? You can donate at the [OWASP Project Wiki Page](https://owasp.org/donate/?reponame=www-project-devsecops-maturity-model&title=OWASP+Devsecops+Maturity+Model). Donations might be used for the design of logos/images/design or travels. |
| 131 | + |
| 132 | +# License |
| 133 | + |
| 134 | +This program is free software: you can redistribute it and/or modify it under the terms of the [GPL 3](https://www.gnu.org/licenses/) license. |
| 135 | + |
| 136 | +The intellectual property (content in the _data_ folder) is licensed under Attribution-ShareAlike. |
| 137 | +An example attribution by changing the content: |
| 138 | +> This work is based on the [OWASP DevSecOps Maturity Model](https://dsomm.owasp.org/). |
| 139 | +
|
| 140 | +The OWASP DevSecOps Maturity Model and any contributions are Copyright © by Timo Pagel 2017-2025. |
| 141 | + |
| 142 | + |
| 143 | +For customized DSOMM, take a look at https://github.com/wurstbrot/DevSecOps-MaturityModel-custom. |
| 144 | + |
| 145 | +You can download your current state from the circular heatmap and mount it again via |
| 146 | + |
| 147 | +```bash |
| 148 | +wget https://raw.githubusercontent.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/main/src/assets/YAML/generated/generated.yaml # or go to /circular-heatmap and download edited yaml (bottom right) |
| 149 | +docker run -p 8080:8080 -v /tmp/generated.yaml:/srv/assets/YAML/generated/generated.yaml wurstbrot/dsomm:latest |
| 150 | +``` |
| 151 | + |
0 commit comments