A startup company deployed several new applications with vulnerabilities into production because security reviews were not conducted. What will BEST help to ensure effective application risk management going forward?
A.
Conduct automated scans on applications before deployment.
B.
Supplement existing development teams with security engineers.
C.
Integrate information security into existing change management.
D.
Create a new governance council for application security.
Integrating information security into existing change management processes ensures that security considerations are included in all application changes and deployments. This addresses the root cause of bypassed security reviews and provides a consistent, repeatable process to manage risk going forward.
“Integrating security into change management ensures that changes to systems and applications undergo appropriate security review and testing prior to implementation, thereby addressing vulnerabilities proactively.”
— CISM Review Manual 15th Edition, Chapter 3: Information Security Program Development and Management, Section: Change Management*
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit