Secure Web Applications – It Starts at the Top A Holistic Approach

Security Best Practices The Big Picture Challenge  An entities’ security program is intrinsic to the availability of its systems, accuracy of its information, and its reputation.  The security program is a complex - intertwining people, processes and technology into a set of complementary controls.  The security program requires validation for ROI, efficacy of controls and alignment to the business objectives and risk tolerances.  The security controls must be bound to the rest of the systems and yield its own metrics and information (the “system within the system”).

Where Does Application Security Fit? ComplianceThreats Risk Management Policies & Training StandardsGovernanceGapsPMOBusiness

How Does Application Security Fit into IT GRC?  Key Data points must be collected from live sources.  Data Modeling and system flow modeling must be done on this complex system.  Start by establishing the most valuable questions that could ideally be answered: What if funding levels were changed? What if development was partially done by a partner? What if business valuation changed on an asset? What if a totally new threat was introduced