Application Security Industry Consortium Established to Develop Cross-Industry Application Security Guidelines, Measurements and Methodologies.

WILMINGTON, Mass. -- Community of Technology Leaders to Define Security Guidelines and Generate Application Security Assessment Criteria

Security Innovation, the independent industry leader in application security testing, research and training, today announced the formation of the Application Security Industry Consortium (AppSIC). Comprised of world-renowned industry technologists and leaders, AppSIC was formed to help establish and define cross-industry application security guidance and metrics.

AppSIC's primary goals are to translate security practices and activities throughout the development lifecycle into business return on investment. This would arm organizations with what they need to make informed application security purchase and deployment decisions. The consortium aims to provide a critical bridge between the academic, industrial, vendor, government and business communities on the challenges of application security. Founding members of the consortium are drawn from such organizations as Compuware, Florida Institute of Technology, Gartner, Inc., IDC, ING, Microsoft, Oracle, Red Hat, SAP, Secure Software, Security Innovation and Yoran Associates.

"AppSIC will focus on developing evaluation methodologies that make application security relevant to business and technology decisions," said Herbert Thompson, Ph.D., consortium chair. "Consumers need to have confidence in the software they buy, build and deploy. Development groups need a yardstick to help them refine their processes and make measurable progress towards security. CxOs need actionable insight into the security of the applications that run their critical business processes. AppSIC's diversity and seasoned membership uniquely position it to deliver metrics and methodologies that meet these needs."

By the end of the year, AppSIC will publish an industry whitepaper around security metrics and ROI. This will serve as the foundation for the metrics and guidelines AppSIC will be defining as part of its mission.

"Security is a critical component of the application development lifecycle," said Mary Ann Davidson, chief security officer, Oracle. "Working with the AppSIC organization to establish application security guidelines, Oracle, the world's largest enterprise software company, can further help organizations better derive business benefits from their security procedures and resources."

"As the world's leading provider of the software that runs companies' mission-critical business processes, SAP requires standardized security assessment criteria that are based upon sound methodologies and perspectives," said Sachar Paulus, chief security officer, SAP. "Making application security measurable needs the commitment of key stakeholders throughout the software community. SAP has joined AppSIC to help drive this mission-critical task objective for the industry and, ultimately, for our customers."

"The IT, network and software development worlds intersect via applications but no one knows how to consistently assess the security of their applications. AppSIC will generate security assessment criteria, proliferate application security knowledge, and help organizations improve their internal processes to address application security across the lifecycle," said Charles Kolodgy, research director, IDC.

Founding AppSIC members include:

Herbert H. Thompson, Ph.D., consortium chair, Security Innovation

Scott Charney, VP, Trustworthy Computing, Microsoft (NASDAQ: MSFT)

Mark Cox, senior research engineer, Red Hat (NASDAQ: RHAT)

Mary Ann Davidson, CSO, Oracle (NASDAQ: ORCL)

Charles Kolodgy, research director, Security Products, IDC

Theresa Lanowitz, research director, Gartner, Inc. (NYSE: IT)

Steve Lipner, senior director of security engineering strategy, Microsoft Corp. (NASDAQ: MSFT)

Serge Moreno, Global Information Risk Management, ING (NYSE: ING)

Sachar Paulus, Ph.D., CSO, SAP (NYSE : SAP)

Dan Schoenbaum, VP, Strategy, Compuware (NASDAQ: CPWR)

John Viega, CTO, Secure Software

James A. Whittaker, Ph.D., professor, Florida Institute of Technology

Amit Yoran, president, Yoran Associates

For more information about AppSIC, please visit www.appsic.org.

About AppSIC

The Application Security Industry Consortium is a community of security and technology experts united to establish and define the cross-industry application security guidelines and measures, seeking to:

--Bridge the gap between application security issues & business needs;

--Develop a yardstick for secure software development processes;

--Generate application security assessment criteria;

--Develop guidelines to address application security issues throughout the software development process; and

--Provide insight on security and business return on investment.

About Security Innovation

Security Innovation, Inc. is the leading independent provider of application security services. Dozens of leading organizations, including Adobe, Cisco, Fidelity, Harris Corporation, IBM, ING, HP, Microsoft, VISA, SAP, Symantec, VeriSign and a number of government agencies, rely on Security Innovation's expertise in application security testing and training to develop, evaluate and deploy more secure applications. More than 60 percent of the Company's staff holds advanced degrees in computer science with 30 percent at the Ph.D. level. The Company is headquartered in Wilmington, Mass., with offices in Amsterdam, The Netherlands; Seattle, Wash.; and Melbourne, Fla. For more information about Security Innovation, visit www.securityinnovation.com or call +1.978.694.1008.