One of the topics we learned in class was about application security. This was an interesting topic since I was left with so many questions on the same. Breaches and application security threats continue to affect applications notwithstanding the cutting-edge solutions being developed. According to Archer et al. (2016), over the years, the awareness concerning application security risk has considerably increased. For instance, organizations or individuals deploying web-based applications know about the legal, financial losses and other liabilities that they are likely to bear in case their applications are compromised. Hence, they are investing in tools, technology, people and processes to ensure safe and high security for the applications (Talabis, M., & Martin, 2012). It is evident that the issue of risk assessment for application security plays a vital role in ensuring secure systems.

In the modern time, the generic risk assessment metrics employed for assessing application security risks do not consummate with the actual risks that are posed. The real risk is usually perceived but not measured. Therefore, it is time to change how companies and individuals manage application security risks. The first step toward application security risk assessment entails gathering as much information concerning the targeted applications (Talabis, M., & Martin, 2012). The security auditors need to convene a meeting and capture the security risks of applications they are using together with the IT experts. The meeting will allow the auditors to examine the Internet Protocols, test data, discuss on the deliverable (application security risk assessment reports, format and the scope). The individuals assessing the risks need to be aware of the URL, IP addresses, types of Internet or Intranet, test credentials, users, data classifications (internal, restricted, public or confidential), application architecture, the size of the applications and other vital information that ensure risk assessment is achieved effectively (Talabis, M., & Martin, 2012). According to Huang et al. (2015), the following sources can help in the determination of vulnerabilities in application security: the previous risk assessment, security advisories, IT application audit reports, security requirements checklists, vendor advisories, security testing and CERT.

The applications which need management as well as assessments can employ the frameworks such as: asset management, inherent risk classification, threat analysis, vulnerability assessment, risk analysis, impact analysis, and finally, risk management (Morana & UcedaVelez, 2011). In asset management, the IT team should determine what the company`s stakeholder management and asset application. Concerning the classification of inherent risk, it entails assigning application security value, which is purely based data sensitivity that is handled by the identified applications. During threat analysis, the team can identify the threats that emerge from the applications including the sensitive data which is processed or stored by the applications and also the functionalities that can impact on the business when compromised or lost (Morana & UcedaVelez, 2011).

For vulnerability assessment, the auditors will identify the possible vulnerabilities which are prone to exploitations from the threat originating from application assets. Vulnerability assessment allows for impact analysis to be undertaken to identify the impacts to information security (loss of confidentiality, availability or integrity) as well as the impact to the business (revenue loss or damage of reputation) when applications are compromised or lost (Morana & UcedaVelez, 2011). In risk analysis, the auditors evaluate the level of the risks based on the probability of the threats and exposure to the application. After identification and analysis of risks, the organizations can manage them through risk management including the measures that are implemented to manage the risks.

In conclusion, it is vital to consider risks management and risk assessment as a significant as well as an essential process for the application security, and for any data assets utilized by a business that needs protection. The establishment of application security risk assessment framework, as well as plans, can go a long way towards ensuring a secure IT infrastructure.