The Manager's Guide to Web Application Security

Ron Lepofsky is the president of ERE Information Security Auditors, which he founded in 2000. He holds the CISSP and CISM security certifications and a degree in mechanical engineering from the University of Toronto. He has extensive experience managing the web application security audit process, advising senior management on remediating security weaknesses, and translating the technical findings of his auditor teams into actionable terms for management.

1. Understanding IT Security Risks 2. Types of Web Application Security Testing 3. Web Application Vulnerabilities and the Damage They Can Cause 4. Web Application Vulnerabilities and Countermeasures 5. How to Build Preventative Countermeasures for Web Application Vulnerabilities 6. How to Manage Security on Applications Written by Third Parties 7. Integrating Compliance with Web Application Security 8. How to Create a Business Case Cost for Web Application Security 9. Parting Thoughts A. COBIT 5 for Information Security B. Experian EI3PA Security Audit C. ISO/IEC 17799:2005 and the ISO/IEC 27000:2014 Series D. North American Energy Council Security Standard for Critical Infrastructure Protection (NERC CIP) E. NIST 800 Guidelines F. Payment Card Industry (PCI) Data Security Standard G. Sarbanes-Oxley Security Compliance Requirements H. Sources of Information