A featured contribution from Leadership Perspectives, a curated forum for enterprise technology leaders, nominated by our subscribers and vetted by the CIOApplications Editorial Board.

Tupperware Brands

Application Security Fundamentals and Coaching Basketball

CoachJohn Wooden (University of California - Los Angeles) started eachbasketball season with the same, fundamental lesson: teaching each player how to put on their socks and tie their shoelaces. The‘why’ behind the seemingly redundant lesson: "…if there are wrinkles in your socks or your shoes aren't tied properly, you will develop blisters. With blisters, you'll miss practice. If you miss practice, you don't play. And if you don't play, we cannot win." In other words, remember the fundamentals.

A question: what are application security fundamentals and how does a technology leader explain them to a project manager or a developer?Two great questions.In order to answer these questions we will make two assumptions for the remainder of the article. The first assumption is our organization is just starting to develop structure around application security. The second assumption is there are limited people, technology, and financial resources to implement the maturing application security.

The fundamentals of application security, which we can explain to any project manager or developer, are:

a. Remember Plan – Do – Check – Act.

b. Engage all stakeholders early.

c. Understand then address risks associated with the application and the data.

d. Re-use approved technology blueprints or processes whenever possible.

Notice these application security fundamentals are not technical controls or detailed processes focused on software development. Instead, they are people and process driven which all team members understand. They are also not a single checklist a developer can apply to every application. These application security fundamentals are leadership focused with the goals of (1) aligning the development & project management teams with the information security & privacy teams, (2) raising security and privacy awareness, and (3) providing opportunities to standardize and improve SSDLC processes for future development projects.

  • If there is organizational friction then the project will slow down and escalation will occur. If the project slows down and escalations occur then everyone will be distracted, which may cause missed deadlines OR longer work hours to make up the time


In practice and in the spirit of Coach Wooden, “…if the team doesn’t follow these fundamentals then there will be organizational friction (i.e. tension, blame or “blisters”). If there is organizational friction then the project will slow down and escalation will occur. If the project slows down and escalations occur then everyone will be distracted, which may cause missed deadlines OR longer work hours to make up the time. It may also cause the team to push through a solution that does not address the risks or require leadership to accept risk the team could address.

These are the application security fundamentals from a leadership perspective. The expectation is the SSDLC will mature and the team will add technical controls with detailed processes. The following checklist is a reference for organizations building out Secure Application Development capabilities.

The articles from these contributors are based on their personal expertise and viewpoints, and do not necessarily reflect the opinions of their employers or affiliated organizations.