Policy 101

What is an AppSec policy, and how should it mature over time?

What Is Policy

  • A security standard you are holding your application to. Examples of well-known security standards that can be imported are: OWASP Top 10, SANS 25, PCI, HIPAA, etc.
  • “Set of rules” that can be changed at any time. The rules can be based on:
  • Business strategy
  • Scan requirements (Static, Dynamic, SCA) 
  • Application vulnerability scoring model 
  • Reporting remediation compliance
  • Remediation frequency 
  • Mitigation process 
  • Vulnerability management strategy


Policy Maturation

  • Typically, programs will start out using Veracode’s prebuilt policies: Veracode Recommended Low/Veracode Recommended Medium
    • Performing baseline scans with these policies gives you a sense of the security posture of your application today without overwhelming developers with numerous findings.
    • Only High/Very High flaws will cause the application to fail the policy. These High/Very High flaws are a great place for your developers to begin fixing flaws.
  • The next step is to build a custom policy with your Security Program Manager (SPM)
    • Create a custom policy based on existing internal security measures.
    • Have multiple policies based on speed in which testing can occur.