Building highly secure applications begins early in the software development life cycle with your developers. That's why instilling application security awareness through Web application development training is one of the first things you want to do. You not only want your developers armed with the latest knowledge on how to code securely--and how attackers exploit weaknesses--but you want them to know how important (and much more efficient) it is to consider security from the start. This awareness building shouldn't end with your Web application development team. It needs to include everyone who plays a part in the software development life cycle: your quality and assurance testing teams, who need to know how to properly identify potential security defects, and your IT management team, who need to understand how to invest organizational resources most effectively to develop security applications, as well as how to successfully evaluate such essential technologies as Web application security scanners, Web application firewalls, and quality assurance toolsets.

By building awareness throughout the Web application development life cycle, you're building one of the most central controls necessary to ensure the security of your Web applications. And while training is essential, you can't depend on it to make certain that your systems are built securely. That's why training needs to be reinforced with additional controls and technology. You need to begin to put into place the elements of a secure Software Development Life Cycle, or SDLC.