Aggregation process for implementation of application security management based on risk assessment

摘要

This article is devoted to the review and analysis of existing methods of ensuring information security based on risk models. The strengths and weaknesses of the model are investigated on the basis of reliability theory. The article discusses potential obstacle to managing application security effectively and describes five steps for managing security. Create inventory of application and their attributes and evaluating their role in business impact (Create a profile for each application and conduction analysis of date processed in the application). Software vulnerability search (Static Analysis (“white-box”); Dynamic Analysis (“black-box”); Interactive Analysis (“glass-box”); Mobile Application Analysis); Risk assessment and prioritization of vulnerabilities (Setting priorities for applications; Setting priorities for types of vulnerabilities; Setting priorities for the development team; Changing vulnerability priorities and reassessing risks). Elimination of vulnerabilities and minimization of risks (security manager sets priorities and firmed tasks for the development team.