Are You Sure That is Secure? Assessing Organizations Security Readiness Via a Devsecops Maturity Model

With the introduction of the DevSecOps manifesto, securing a software supply chain demands more than technical measures. DevSecOps requires a security culture and shared responsibility among all the employees of a company. Keeping track of all the best security practices and ensuring the security readiness of companies with different core businesses is hence a challenging task. To solve this issue, organizations and researchers proposed maturity models, i.e., structured evaluation forms that help identify gaps in companies' security practices with respect to the standard required ones. However, currently existing maturity models cannot cover all the aspects of a DevSecOps pipeline, with limitations including secure data lifecycle management, education and training, and cloud security. In this paper, we propose Maturity Model for DevSecOps (MM4DSO), a novel maturity model that fills our previously identified gaps. Thanks to a set of 320 multiplechoice questions divided into six security domains, MM4DSO evaluates the maturity level of a company and highlights gap areas that require improvement. To ease the assessment, we formulate questions with a unified set of answers to identify a maturity level between one and four. To assess the viability and usefulness of MM4DSO, we tested it on five real-life companies, achieving an average subministration time of one and a half hours and highlighting that critical areas are those related to less classical security practices. Lastly, we propose a theoretical framework to guide security patches based on the results of MM4DSO and the available budget.