Application security represents the security layer whose governance the Security Consulting function must address with particular strategic urgency, because the modern organisation’s business processes are increasingly delivered through software applications whose security quality directly determines the security of the data they process, the access they control, and the transactions they execute. The application is the interface through which the organisation’s customers interact with its services, through which its workforce performs its operational functions, and through which its data flows between the systems that create, process, store, and transmit the information assets whose protection the security programme exists to ensure. A vulnerability in the application layer whose exploitation the adversary achieves can defeat the most rigorous network security architecture, the most comprehensive endpoint protection, and the most diligent access management programme, because the application vulnerability provides the access path that circumvents every control whose protection the layer below the application provides.
The Security Consulting function must govern the application security advisory with the full lifecycle perspective that recognises the security quality of the application as the product of every decision made from the earliest specification through the design, the development, the testing, the deployment, and the ongoing maintenance that the application’s operational lifespan requires. The security vulnerability that the inadequate input validation in the original design creates, that the development team’s security training gaps translate into the exploitable code, that the application security testing fails to identify before deployment, and that the patch management programme fails to remediate promptly after the vulnerability’s post-deployment discovery represents the lifecycle security failure whose prevention requires the security governance at every stage rather than only the post-deployment assessment that the compliance-oriented approach most commonly deploys as its primary application security investment.
Secure Development: The Security at the Source Investment #
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
