ISO/IEC 27034 Foundation study plan

Define application security in your own words and distinguish it from network, host, and data security, citing at least three concrete differences

Explain the CIA triad plus authenticity, accountability, and non-repudiation, and give one application-level failure example for each

Map the core vocabulary of ISO/IEC 27034 (application security control, application security control library, application security management process, targeted assurance level) into a personal glossary of at least 15 terms

Describe why securing the application layer requires controls embedded in the software lifecycle rather than perimeter defenses alone

Outline the overall architecture of the ISO/IEC 27034 multi-part standard and state the purpose of each part at a high level

Explain the concept of an Application Security Control Library and how it supports reuse of controls across projects

Compare the standard's process-oriented approach with ad hoc checklists and penetration-test-only approaches

Identify the actors and roles the framework assumes (application owner, developer, assessor, auditor) and what each is responsible for

Describe the structure of an application security control entry, including identifier, objective, risk, implementation guidance, and verification method

Explain the role of the organization's application security policy and how it cascades into control selection

Trace how an organization-level control library is tailored to a specific application's context

Distinguish the concepts of targeted assurance level, application security risk, and business context, and explain how they interact during control selection

Explain how ISO/IEC 27034 positions assurance levels and how an organization decides the appropriate level for a given application

Describe the risk assessment process for applications: identifying business context, threat landscape, and data sensitivity

Practice scoping an assessment for an application and justify the chosen assurance level in writing

Compare the standard's assurance approach with common alternatives such as maturity models and third-party certification

Walk through a full application risk assessment using a structured method: asset identification, threat modeling, likelihood and impact rating, and risk treatment

Select controls from a library to treat the identified risks and document the rationale for each selection

Define verification activities for each selected control, distinguishing design review, code review, testing, and runtime monitoring

Explain how residual risk is documented and accepted by the appropriate authority

Describe how application security controls are integrated into each lifecycle phase: requirements, design, development, testing, deployment, and operation

Explain how to establish and maintain an organization's application security control library, including governance and review cadence

Identify the evidence an auditor would expect to see for control implementation and verification

Draft a process for handling exceptions and deviations from required controls

Design an organizational rollout plan for an application security management process, including roles, training, and tooling

Explain how ISO/IEC 27034 relates to and complements other management frameworks and standards such as ISO/IEC 27001 and secure development guidance

Identify metrics that demonstrate the health of an application security program and describe how to report them to management

Plan how to audit and continuously improve the control library and the management process

Review all four domains and close gaps identified in earlier weeks' deliverables

Practice explaining the standard's structure, control library concept, and assurance approach aloud without notes

Work through scenario questions that require selecting controls and justifying assurance levels under time pressure

Revisit your glossary and update any definitions that were imprecise or incomplete