Fundamental Concepts and Principles of Application Security and ISO/IEC 27034
This section covers Domain 1: fundamental concepts and principles of application security and ISO/IEC 27034. The exam tests whether you can explain why application security is lifecycle-wide, risk-based and evidence-driven, and how the standard's vocabulary fits together.
Core ideas
Application security protects the confidentiality, integrity and availability of an application's data and supporting business processes across its lifecycle, not only its code. ISO/IEC 27034 is a framework standard: it helps an organization define, select, implement and validate application security controls; it does not prescribe a one-size-fits-all checklist or certify a product.
The Organization Normative Framework (ONF) is the organization-level reference set of policies, standards, procedures, risk criteria and Application Security Controls (ASCs). An Application Normative Framework (ANF) is the application-specific subset created by tailoring the ONF to one application's context and risk. ASCs are reusable control statements with implementation and verification guidance, held in an ASC library.
Trust is confidence that an application will behave as required; assurance is the evidence-based grounds for that confidence. Both depend on traceability from business context and risk to selected ASCs, implementation and validation evidence.
Worked example
A hospital plans a patient portal. The team records business context (patients access records), legal constraints and data sensitivity. It assesses risk: unauthorized record access could cause serious harm, so likelihood and impact are high. From the ONF it selects ASCs for strong authentication, role-based access, audit logging and encryption. These selections, with tailoring rationale, form the portal's ANF. Validation then tests the controls and records evidence. The reasoning: risk drives control strength, and the ANF documents why this application's controls differ from another app's.
Traps
Do not equate application security with secure coding only; process, data and third parties matter. Do not confuse the ONF (organization-wide) with the ANF (one application). Do not treat 27034 as a certification scheme for software. Do not claim assurance from a control being implemented without validation evidence.