Application Security
What is Application Security?
The practice of finding, fixing, and preventing security vulnerabilities in software applications throughout the development lifecycle. Includes code review, penetration testing, and security architecture design.
Terms that appear alongside application security
Each of these is named in at least one of the same controls as application security. The number is how many controls name both.
- security testing 14 shared controls
- application security testing 14 shared controls
- cybersecurity 12 shared controls
- vulnerability 10 shared controls
- authentication 9 shared controls
- owasp 8 shared controls
- secure coding 8 shared controls
- security controls 8 shared controls
Frameworks that govern application security
What the standards actually require on application security
Requirements naming application security across 6 standards, quoted from the control text.
Information security requirements are to be identified, specified and approved whenever applications are developed or acquired. Purpose: leave no security requirement unidentified or unaddressed when an application is built or bought.
iso-27002-2022::8.26 · Application security requirements →The organisation sets down and keeps up to date the baseline security requirements that applications must meet.
cloud-security-alliance-cloud-controls-matrix-ccm-v4-1::AIS-02 · Application Security Baseline Requirements →Referenced by 14.1.4. Measures to consider for mobile applications: avoid storing or caching data in the app and keep data in a protected, trusted area of the device; protect private cryptographic keys;
monetary-authority-of-singapore-technology-risk-management-guidelines::C · Annex C Mobile Application Security →Define and keep current the minimum security requirements each class of application must satisfy before it is built or released.
CCM-AIS-02 · Application Security Baseline Requirements →Make sure everyone who develops software is trained to write secure code suited to their own development environment and duties. Training may cover general security principles and standard application security practice.
CIS-16.9 · Train Developers in Application Security Concepts and Secure Coding →Make sure everyone who develops software is trained, at least yearly, in writing secure code for their own environment and responsibilities, covering general security principles and standard application security practice, delivered in a way that builds a secur...
cis-controls-v8-1::16.9 · Train Developers in Application Security Concepts and Secure Coding →Questions people ask about application security
What is Application Security?
Why is Application Security important for compliance?
Which compliance frameworks address Application Security?
Where can I learn more about Application Security?
See how Application Security applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.