The document discusses the importance of conducting application security risk assessments throughout the Software Development Life Cycle (SDLC) to identify and mitigate risks. It highlights key strategies, including threat modeling during the design phase, secure code reviews during development, and security testing during the testing phase. Continuous risk assessment is emphasized as a critical process to ensure vulnerabilities are addressed before software release.

1. Application Security Risk Assessment
Introduction
Thomas Kurian Ambattu,
CRISC, ISO27001 LA, ISLA-2011 (ISC)²

2. Why Risk Assessment?
Risk assessment process helps to identify the risks.
The identified risk can be mitigated and brought
down to an acceptable level.

3. Risks & SDLC
It is always a good idea to identify the risks during the
various stages of SDLC ( Software Development Life Cycle).
This will ensure that the risks are mitigated before
proceeding to the next phase.

4. Risk Assessment During SDLC
Design Phase
Threat Modelling
Development Phase
Secure Code Review
Testing Phase
Security Testing

5. Risk Assessment methods…
Threat Modelling
Helps to identify the risks at the early stages of the development. Threat Modelling if done religiously in
the design phase, will identify the threats and can be fixed before entering the coding phase.
Secure Code Review
Helps to identify the flaws in the code and stops a potential vulnerability that may be exploited by an
attacker. Secure code review involves manual process and the use of automated tools
Security Testing
In the testing phase, apart from the functional testing, security testing shall also be performed. This
involves vulnerability assessment and penetration testing. These tests helps to ensure that the
potential flaws are identified and fixed before the release.

6. Feeders
Threat
Modelling
Secure Code
Review
Security
Testing
These methods will act as feeders for your risk assessment
Application Security
Risk Assessment

7. Application Security Risk Assessment is a continuous process. The
challenge is to ensure that risks are identified and brought down to
an acceptable level.
Summary

8. Thomas Kurian Ambattu
CRISC, ISO27001 LA, ISLA-2011 (ISC)²
http://riskandcontrols.org