Building Application Security Program – 4

This is the final post in the series of four posts. In the first post, we covered the overview of our 3 phase approach to build an application security program, followed by a second post describing the first phase i.e. Assessment and 3rd post providing details on our second phase i.e. Design.

Today, we will discuss the final step i.e. implementing the application security program. This is the phase where we will make a decision on the strategy to implement and actually implement the program.

It is a known fact that the introduction of an application security programme in an organisation is not just a technical challenge,  it also brings a big cultural change with it. It impacts the way people do their day-to-day tasks. Hence, it is important that we introduce the program in phases for easier adoption while discarding the big bang approach.

The figure below provides an example of how the twelve security practices could be divided in phases.


Figure 1 – Introducing Security Practices in Phases for Easier Adoption

In the first phase, we are only introducing foundational practices i.e. practices required to give direction to an application security program such as ‘Strategy and Metrics’ and ‘Policy and Compliance’. In addition, we introduce the practices, which we deem can be easily adopted by the teams based on the ‘Assessment’ results. E.g. if a development team is using static analysis for measuring code quality, it will more than likely be happy to adopt static analysis for identifying security vulnerabilities as well.

Some of the practices can be further broken down into multiple activities. In which case a practice itself may be introduced in phases e.g. ‘Security Testing’ (as demonstrated in above example) or may only be implemented partially, depending upon business requirements.

Finally, Education is a practice, which is evolutionary and continuous.  Therefore, attributing education to any one phase cannot be justified.  Education doesn’t only refer to providing secure coding training to developers, but all the teams involved in the application security program are to be trained in performing the security activities they are accountable and/or responsible for. New courses are added and existing courses evolve throughout the life of the application security programme.

As demonstrated below, we can foresee the interim maturity state after the introduction of phase 1 and subsequent phases. This may also allow us to visualise if we are heading in the right direction in order to meet business objectives.


Figure 2 – Program Roadmap to Visualise Interim Maturity State of the Organisation

While dividing the security practices into phases makes it easier for application security processes to be introduced, we should not forget that it is all theoretical at this stage. And, a less effective process introduced to a large audience may become a reason for the organisation to lose trust in the program. Hence, the recommended approach to deploy the program is to start with introducing each phase as a PILOT to a small group, preferably those who participated in the assessment. During the PILOT, we monitor and analyse the impact of introduction of the programme. Based on the observations and feedback, we may need to adjust the processes designed in Phase 2.

As a second step (i.e. prior to introducing the programme to the wider community), we should create a program support team (i.e. a group of individuals from security and development teams) with keen interest and knowledge of application security. Once trained, this team will support the wider audience in effectively using the processes and/or technologies introduced through the programme.

Now, we introduce the programme to the rest of the organisation while continuously monitoring changes (due to the rollout) and periodically assessing what worked and what didn’t. We use this information to expand the programme, refining controls and, lastly, mandating the controls one-by-one.


This post was originally published by me at

Building Application Security Program – 3

This is the 3rd post in the series of four posts. In the previous post, we looked at the first step of building an application security program i.e. Assessment.

In this post, we will discuss the proven approach to design an effective and scalable application security program for an enterprise.

By the time we enter the Design phase, we already have an understanding of organization’s security culture including:

  • Software security objectives
  • Security activities being performed and corresponding effectiveness
  • Strengths and weaknesses of existing software development and security teams as well as processes

In design phase, we further process this information to identify the actual gap between the current level and the desired level of software security maturity. We create a plan to fill the identified gaps while leveraging the organization’s development team’s strength. For which, we take the data collected during assessment and mix it with industry best-practices in order to produce lightweight, easy to adopt processes and actionable guidelines that can be easily introduced in the organization.

The artifacts produced during the design phase and the approach to create these artifacts is explained below:

Security Requirements: Almost every organization needs to comply with requirements enforced by one or more government or industry regulatory bodies to stay in the business. Hence, we start with identifying the software security requirements and processes the organization must perform to satisfy compliance mandates. These requirements are then correlated to other security requirements compiled to achieve business objectives. The resultant list is a single comprehensive set of security requirements that the programme needs to achieve through adequate and effective usage of people, process and/or technology. A set of technical controls with implementation instructions is also created to fulfil the defined security requirements.

Secure Software Development Lifecycle:  Next step in the design phase is to create a secure Software Development Lifecycle which is the core of any application security programme. It is not recommended that a new process be created from scratch unless absolutely necessary. Instead, we should take the organization’s existing SDLC process and improvise it by seamlessly weaving the security activities in it while ensuring the process enables the organization to meet the security requirements compiled earlier. The secure SDLC should clearly identify which security activities are to be performed manually and which could be automated.

Roles and Responsibilities: Several application security programmes fail despite having a good, secure SDLC. This is mostly because, although security activities have been defined within the SDLC, no one is made responsible or accountable for the execution of these activities.  Therefore, it is very important to clearly identify the responsibilities and accountabilities for the defined security processes and activities.

In the image below, a sample RACI chart is shown for static code analysis activity. It explicitly defines that the Development Team Lead is accountable for scanning the code, whereas the Information Security Team is responsible for triaging the results of static analysis with the consultation of development teams.



Application Risk Classification Criteria: Not all applications pose the same risk to the organisation hence, it is not viable to perform equivalent security measures on all applications. To overcome this, we create “Application Risk Classification Criteria” in which we can utilise the application attributes such as data being handled by the application, accessibility, business criticality, etc to define the potential risk of the application. This can help development teams identify security requirements the application must comply with and which technical controls are to be implemented to fulfil these requirements.

Software Security Education Matrix: It is a known fact that an application security program requires a thorough, role specific and methodical software security education program to be successful. Hence, we use the assessment results to identify the area of focus and create a training matrix suggesting what role specific trainings are required.

Once all these artefacts have been prepared, we are ready to move into our next phase which is implementing the application security program. This will be discussed in the next and final post of the series. Stay tuned!

This post was originally published by me at .

Building Application Security Program – 2

This is second in a series of 4 posts. In this series, we are discussing the recipe to build and implement an effective application security program. If you haven’t already, I suggest you to start from first post.


The first step of an organization’s application security journey should be “Assess” i.e. Assessment.  In this step, we want to understand:

  • Organization’s Software Security Goals
  • Software Security activities performed in the organization and the depth of the execution of these activities
  • Strengths of the development and operations teams as well as areas requiring attention based upon business goals and objectives.

All this information is then used to design the program which we will cover in the next post.

Assessment can be divided into two phases:

Software Security Strategy Assessment

This is the most important task in the Application Security Program Lifecycle as the whole program revolves around the results of this phase.

It starts with Identifying organization’s software security goals and objectives. The best way to gather this information is by interviewing the business leadership in order to:

  • Understand organization’s vision and business goals
  • Evaluate executive’s understanding of their software security needs i.e. is there adequate buy-in from management
  • Identify the impact of lack of software security to business goals.

Once business goals have been identified, the data-related, existing software security initiatives and practices are documented. This is performed by:

  • A series of interviews with relevant Software Security Assurance (SSA) program stakeholders involved in project management, security, requirements, design, development (in-house and outsourced), and deployment processes
  • Reviewing existing organizational software security policies, SDLC artefacts, secure coding standards and guidelines.

Interviewing the stake holders provides insight into organization’s attitude towards software security initiatives whereas reviewing the documents help with an understanding of whether the activities are actually being performed and how well they are being performed.

Assessing the security strategy could be a complex (and ambiguous) task unless guided by a proven framework or maturity model and there are few available for this purpose. Two such popular models are described below:


BSIMM is a descriptive maturity model and describes a set of security practices as conducted by global participants, with real-world data from 67 firms including Microsoft, Adobe, Zynga, Salesforce, Citi, Bank of America, Box, Paypal and many others ( ). Results of a BSIMM assessment can be used compare the initiatives with peers and industry leaders already participating in the studies. For more details, refer


OpenSAMM a.k.a. SAMM is prescriptive model to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. For more details, refer

 By mapping the information gathered to these maturity models, a current security state model as well as a future state model can be created for the organization.


Technical Assessment

Although interviewing the stakeholders and reviewing the documents is one of the most effective ways to assess the software security maturity of an organization, it fails to provide two important pieces of information:

  • Technical impact of gaps in security strategy – important for building business case to achieve management support for the next stages of the program
  • Secure coding areas requiring most focus during the trainings to be provided to development teams

This part is easy and can be achieved either by performing the security assessment (Code Review and Penetration Test, in tandem is preferred) and evaluating the results OR by reviewing the recent security assessment reports for some of the major business applications.

 From Assessments we have gleaned three important pieces of information.

  • Where we are
  • Where we need to be
  • Strengths we can leverage and weaknesses we need to overcome

 And once we have these three things, our journey becomes easier…

In the next post, we will look at “Designing an Application Security Program”. We will discuss what needs to be covered in the program and related gotchas.


This post was originally published at my employer’s site by me.