A good first step towards the implementation of a secure SDLC is to take stock of your existing applications.  All applications within your organization carry with them a certain level of risk.  This risk needs to be quantified in order to guide you towards making effective decisions about security tradeoffs.

Classifying your applications from a security perspective helps provide input into your asset management process.  Below are some items to consider, in multiple choice format.  Answers to the questions below can be assigned a specific weight.  The options are listen in order of increasing weight:

1. What is the scope of the application’s use?
   1. Internal, within a department?
   2. Internal, across multiple departments?
   3. External (customer, business partner, vendor, supplier)?
2. What kind of information does this application store, process, or transmit?
   1. Public information?
   2. Internal?
   3. Customer confidential?
3. What is the approximate size of the end-user base?
   1. Less than 50?
   2. Between 50 and 100?
   3. Between 100 and 250?
   4. Between 250 and 500?
   5. Greater than 500?
4. What is the approximate budget allotted to this application?
   1. Less than $50,000?
   2. Between $50,000 and $100,000?
   3. Between $100,000 and $500,000?
   4. Between $500,000 and $1M?
   5. Between $1M and $5M?
   6. Greater than $5M?
5. What kind of financial transactions are executed by this application?
   1. No transactions
   2. B2B
   3. B2C

In a future post, I’ll move into CIA considerations for assessing your application’s risk.