Difference between revisions of "Top 10-2017 What's Next for Organizations"

Get Started

• Establish an application security program and drive adoption.
• Conduct a capability gap analysis comparing your organization to your peers to define key improvement areas and an execution plan.
• Gain management approval and establish an application security awareness campaign for the entire IT organization.

Risk Based Portfolio Approach

• Identify and prioritize your application portfolio from an inherent risk perspective.
• Create an application risk profiling model to measure and prioritize all your applications and APIs.
• Establish assurance guidelines to properly define coverage and level of rigor required.
• Establish a common risk rating model with a consistent set of likelihood and impact factors reflective of your organization's tolerance for risk.

Enable with a Strong Foundation

• Establish a set of focused policies and standards that provide an application security baseline for all development teams to adhere to.
• Define a common set of reusable security controls that complement these policies and standards and provide design and development guidance on their use.
• Establish an application security training curriculum that is required and targeted to different development roles and topics.

Integrate Security into Existing Processes

• Define and integrate secure implementation and verification activities into existing development and operational processes. Activities include Threat Modeling, Secure Design & Review, Secure Coding & Code Review, Penetration Testing, and Remediation.
• Provide subject matter experts and support services for development and project teams to be successful.

Provide Management Visibility

• Manage with metrics. Drive improvement and funding decisions based on the metrics and analysis data captured. Metrics include adherence to security practices / activities, vulnerabilities introduced, vulnerabilities mitigated, application coverage, defect density by type and instance counts, etc.
• Analyze data from the implementation and verification activities to look for root cause and vulnerability patterns to drive strategic and systemic improvements across the enterprise.