# What is Application Security?

> Application security is the discipline of reducing security risk in software and the systems on which it depends throughout planning, design, development, testing, release, operation, and retirement.

- Canonical URL: https://yellowcube.eu/glossary/application-security/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It covers first-party code, third-party components, identities, data, interfaces, configuration, deployment, and runtime behavior across web, mobile, desktop, service, and embedded applications. It is an ongoing engineering and governance responsibility, not a final test.

A useful program translates organizational risk into application requirements and repeatable practices, assigns decisions to accountable owners, and feeds production findings back into design and development. The depth of work should reflect the application’s data, privileges, exposure, dependencies, and potential consequences of failure.

### Key points

- **Design and governance:** Maintain an application inventory, define security and privacy requirements, model threats and trust boundaries, choose safer architectures, and record accepted risks and exceptions.
- **Build and supply chain:** Apply secure coding practices, review changes, protect development and release systems, govern dependencies, secure configuration, and produce traceable artifacts.
- **Verification and operation:** Combine code review, static, dynamic, and composition analysis with focused manual testing, runtime monitoring, vulnerability handling, incident response, and verified remediation.
- **Important limitation:** No tool, test, framework, maturity score, or release gate can prove that an application is secure. Coverage changes with architecture, environment, attacker behavior, and application evolution.

### Related terms

[Web application security](<https://yellowcube.eu/glossary/web-application-security/>) · [Application programming interface (API) security](<https://yellowcube.eu/glossary/application-programming-interface-security/>) · [DevSecOps](<https://yellowcube.eu/glossary/devsecops/>) · [Static application security testing (SAST)](<https://yellowcube.eu/glossary/static-application-security-testing/>) · [Threat modeling](<https://yellowcube.eu/glossary/threat-modeling/>) · [Cloud application security](<https://yellowcube.eu/glossary/cloud-application-security/>) · [Runtime application self-protection (RASP)](<https://yellowcube.eu/glossary/runtime-application-self-protection/>) · [Mobile application security](<https://yellowcube.eu/glossary/mobile-application-security/>)

### Sources

[NIST SP 800-218: Secure Software Development Framework](https://csrc.nist.gov/pubs/sp/800/218/final) · [OWASP Software Assurance Maturity Model](https://owaspsamm.org/model/) · [OWASP Application Security Verification Standard 5.0.0](https://owasp.org/www-project-application-security-verification-standard/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.