Question 133 - CISM discussion

Introducing security requirements during the initiation phase would BEST ensure that security is integrated during application development because it would allow the security objectives and controls to be defined and aligned with the business needs and risk appetite before any design or coding is done.This would also facilitate the security by design approach, which is the most effective method to enhance the security of applications and application development activities1.Introducing security requirements early would also enable the collaboration between security professionals and developers, the identification and specification of security architectures, and the integration and testing of security controls throughout the development life cycle2. Employing global security standards during development processes (A) would help to ensure the consistency and quality of security practices, but it would not necessarily ensure that security is integrated during application development. Providing training on secure development practices to programmers (B) would help to raise the awareness and skills of developers, but it would not ensure that security is integrated during application development. Performing application security testing during acceptance testing would help to verify the security of the application before deployment, but it would not ensure that security is integrated during application development.It would also be too late to identify and remediate any security issues that could have been prevented or mitigated earlier in the development process.Reference=1: Five Key Components of an Application Security Program - ISACA1;2: CISM Domain -- Information Security Program Development | Infosec2