Application Security

Application Security: Protects software against vulnerabilitiesVulnerabilityA technical or organizational weakness that can be exploited by a threat. during development, operation, and maintenance. The term relates to the security of applications, interfacesInterfaceA defined boundary through which systems, components, or users exchange data and commands., or development processesDevelopment ProcessThe organized workflow used to design, implement, test, release, and maintain software.. Relevant measures range from secure designSecure DesignDesigning systems so security requirements and trust boundaries are addressed before implementation. and testing to runtime protectionRuntime ProtectionSecurity controls that observe or restrict an application or workload while it is executing. and rapid remediationRemediationThe correction or mitigation of a confirmed security weakness, defect, or misconfiguration..

How it works and where it fits

Application Security is a building block of security architecture that must be understood in its system and business context. Its intended objective, affected trust boundaries, prerequisites, and interaction with other controls are decisive. An isolated definition is therefore not sufficient for implementation or assessment.

Practical security relevance

Sound implementation assigns ownership, configuration, data sources, and verifiable success criteria. Assumptions and exceptions should be documented and changes controlled. Periodic testing shows whether the concept reduces risk in the actual environment or has merely been addressed as a formal requirement.

Related concepts

• Open Web Application Security ProjectOpen Web Application Security ProjectNon-profit community providing standards, tools, and knowledge bases regarding application security.: Non-profit community providing standards, tools, and knowledge bases regarding application security.
• Dynamic Application Security TestingDynamic Application Security TestingTests a running application from the outside for exploitable vulnerabilities.: Tests a running application from the outside for exploitable vulnerabilities.
• Mobile Application Security TestingMobile Application Security TestingTesting mobile apps, their communication, and backend interfaces for vulnerabilities.: Testing mobile apps, their communication, and backend interfaces for vulnerabilities.
• Secure CodingSecure CodingProgramming practices aimed at avoiding common vulnerabilities and misconfigurations.: Programming practices aimed at avoiding common vulnerabilities and misconfigurations.