Definition
Application security refers to the protection of government digital and ICT applications from threats such as unauthorised access and modifications. It covers the security aspects specific to the application design, development and deployment, as well as the systems and methods used to secure apps after they are deployed.
Purpose
Application security ensures that security is an integral part of the application lifecycle. This can help mitigate vulnerabilities, reduce the risk of security breaches and protect sensitive data and systems so the applications deliver on their purpose and intent.
A mature Application Security capability enables a fast and appropriate response to emerging threats and continuous improvement of security status.
Application security is realised through:
- the definition, planning, deployment and use of appropriate security measures (including policies/processes and technological solutions) to protect applications
- consideration of the capability as part of a complementary suite of security capabilities, including Information Asset Security, Network Security, Privacy, and Permissions.
Objectives
The objectives of this content are to ensure:
- application solutions across government are implemented to a standard relevant to their organisation’s risk appetite regarding security
- entities are familiar with application security best practices, allowing them to make informed decisions on investment in application security
- new application solutions are informed by preceding investments, implementations, and learnings to maximise re-use and minimise risks
- strategic alignment of application security features to the Australian Government’s cyber security goals
- minimum compliance with contractual obligations, legislation and regulation, government policies and standards and any national or international agreements relating to application security.
Whole-of-government applicability
On 22 November 2023, the Australian Government released the 2023-2030 Australian cyber security strategy, a roadmap that will help realise the Australian Government’s vision of becoming a world leader in cyber security by 2030. The capability of Application Security supports its agenda through:
- ensuring that security considerations are incorporated into the design, development, and deployment of applications across the Australian Public Service
- developing a unified and comprehensive approach to this capability to fortify individual applications and contribute to the overall resilience and security posture of the entire government infrastructure
- preventing vulnerabilities, reducing the risk of security breaches, and protecting sensitive data and systems.
The Data and digital government strategy sets a vision for 2030 to deliver simple, secure and connected public services for all people and business, through world class data and digital capabilities.
Maturity in the capability of Application Security will be of critical importance to the Strategy's missions:
- Trusted and secure: The Australian Government commits to improving and maintaining trust in its use of data and digital technologies including through adopting robust and appropriate privacy and security settings to keep peoples’ information safe.
- Simple and seamless services: The Australian Government commits to ensuring technology is scalable, secure, resilient and interoperable, with new systems and infrastructure that supports data access and discoverability.