Infographic: Five Steps for Risk-Based Application Security Management

1. Your next step for secure applications
The 2015 Gartner Magic Quadrant for Application Security Testing names IBM as
a leader in application security testing.2
The Forrester WaveTM
: Application Security, Q4 2014 names IBM as a leader in
application security.3
IBM®
Application Security Solutions enable testing for your web and
mobile applications prior to their deployment, helping you to…
Get the new IBM e-guide to learn how to secure your applications and how IBM AppScan®
can help.
Strengthen
regulatory compliance
Who's a Recognized Leader in Application Security?
Identify security
vulnerabilities
Receive fix
recommendations
Generate
reports
Software applications are part of the critical infrastructure of
practically every organization. They empower …
Despite their importance, application security is extremely difficult
for most businesses to achieve.
37%
of all security
risks occur
at the application layer1
65%
of organizations
had a SQL Injection
attack that successfully
evaded perimeter
defenses in 20141
16%
of all attack types
with a disclosed cause
were attributable to just
two types of application
attacks—SQL Injection
and Cross-Site Scripting1
2
Strategic
business
processes
Interaction
with customers
and business
partners
Sensitive
customer and
employee data
Most of the
organization’s
intellectual
property
Follow these practical steps to help secure
your applications:
Create an inventory of application
assets and assess their business impact
Test the applications for vulnerabilities
Determine the risks and prioritize vulnerabilities
Remediate the risks
1
2
3
4
5
Measure progress and
demonstrate compliance
Five Steps for Risk-Based
Application Security
Management
© Copyright IBM Corporation 2015. IBM, the IBM logo, ibm.com and AppScan are trademarks of IBM Corp., registered in many jurisdictions
worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on
the Web at “Copyright and trademark information” at www.ibm.com/legal/copytrade.shtml.
1. Ponemon Institute: The Rise of Risk-Based Security Management, 2013 and The SQL Injection Threat Study, 2014; IBM X-Force Threat
Intelligence Quarterly, 1Q 2015
2. “Magic Quadrant for Application Security Testing.” Feiman, J. and MacDonald, N. Gartner. August, 2015. Web.
3. “The Forrester Wave: Application Security, Q4 2014.” Shields, T. Forrester Research. December, 2014 Web.
Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with
the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements
of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
THE INFORMATION IN THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING WITHOUT ANY WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ANY WARRANTY OR CONDITION OF NON-INFRINGEMENT. IBM products are warranted according
to the terms and conditions of the agreements under which they are provided.