Application Management - Cyber City Map

# Application Management Application Management is an [[Foundational Capabilities|Information Technology]] capability and foundational dependency for [[Cybersecurity]]. Application Management is often provided through a commercial automated solution and sometimes includes both purchased and organization-developed applications depending on industry and org goals. ## Map ``` mermaid  graph TD subgraph two[Foundational] subgraph subPadding1[ ] direction LR F[Application Management] G[Asset Management] H[Backup and Recovery] I[Code Management] J[Data Management] K[Device Management] L[Domain Management] M[Email Management] N[Identity and Access Management] O[Log Management] P[Network Management] Q[Policy Automation] R[Stream Processing] S[Third Party Management] T[Training] F ~~~ G G ~~~ H H ~~~ I I ~~~ J K ~~~ L L ~~~ M M ~~~ N N ~~~ O P ~~~ Q Q ~~~ R R ~~~ S S ~~~ T end end %% Class Definitions %% ===================== class two subPadding; classDef subPadding fill:none,font-size:20px; class subPadding1,subPadding2 subgraph_padding; classDef subgraph_padding stroke:none,fill:none,margin:0; class F,G,H,I,J,K,L,M,N,O,P,Q,R,S,T internal-link,font-color:white; class Top cssClassL0; classDef cssClassL0 fill:black,stroke:#333,stroke-width:4px,font-size:15px,font-color:white; class A,B,C,D,E,F,G,H,I,J,K,L,M,N,O,P,Q,R,S,T cssClassL1; classDef cssClassL1 fill:gray,stroke:#333,stroke-width:0px,font-size:15px,font-color:white; class F cssClassCurrent; classDef cssClassCurrent fill:#2f9503,stroke:#2f9503,stroke-width:4px,font-size:15px,font-color:white; ``` ## Definition >[!cm-definition] Definition >**Application Management** is the capability of governing software applications throughout an end-to-end lifecycle, from installation, through improvements, and to end of life. ## Process This is a basic depiction of the high level application management process for the purpose of identifying its relationship to cybersecurity capabilities. ```mermaid flowchart LR A[1. Model Business Capabilities] B[2. Identify Needs and Requirements] C[3. Source Application] D[4. Install Application] E[5. Operate Application] F[6. Measure Application] G[7. Improve Application] H[8. Exit Application] A --> B --> C --> D --> E --> F --> G --> H --> A ``` ## Maturity Model The maturity of application management from a cybersecurity perspective is driven by its readiness in achieving the organization's adversary reduction goals. | | Stage 1 | Stage 2 | Stage 3 | Stage 4 | Stage 5 | | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------ | | | ***Ability to Respond, Fix, and Restore*** | ***Ability to Plan, Protect, and Monitor*** | ***Ability to Build, Verify, and Defend*** | ***Ability to Strategize, Refine, and Triage*** | ***Ability to Predict, Optimize, and Improve*** | | **Category** | Application Inventory Defect Tracking Internet-Exposed Application Inventory Patch Management | Application Hardening Application Lifecycle Application Monitoring | Application Design & Architecture | Dependency Tracking Use Case Management Version Tracking | Application Optimization Application Risk Score | | **Dependent Capability** | [[Asset Restoration]] [[Incident Management]] [[Remediation Management]] | [[Alert Correlation]] [[Deny Listing]] | [[Application Decoys]] [[Case Management]] [[Defense Modeling]] [[Resilience Testing]] | [[Allow Listing]] [[Attack Surface Enumeration]] [[Exploit Management]] | [[Adversary Intelligence]] | ## Requirements This table contains the dependency requirements for Application Management to provide the foundational support for dependent Cybersecurity capabilities. | Category & Function | Guidance | Dependent Capability | Adversary Personas | | ------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Application Design & Architecture** Identify project opportunities and build vs. buy decisions | + Capture business requirements for an application, including any goals related to abuse management. + Identify potential capability improvements to meet goals. + Document the application architecture for achieving business requirements and goals. + Ensure business requirements include abuse constraints. + Identify technical requirements for build vs. buy decisions. + Document the ideal state. | [[Persona Management]] [[Defense Modeling]] | [[Cyber Researcher]] [[Money Movers]] [[Phishing]] [[Weaponizer]] | | **Application Development** | + Implement security features to mitigate abuse. + Use only hardened application components. | | | | **Application Hardening** | + Ensure proper integration with other capabilities (IAM and Code Management, etc.). + Ensure all needed controls are implemented to reduce the potential for misuse and abuse of an application. | [[Resilience Testing]] | [[Bug Bounty]] [[Cyber Researcher]] [[Insider Threat]] [[Red Team]] | | **Application Integration** | | | [[Supply Chain]] | | **Application Inventory** Govern applications to achieve efficiency and lower risk. | + Assign a unique identifier to each application. + Application Owners are clearly identified and continuously updated. + All changes and application work can be traced to the Application identifier. + The inventory can be queried through automated methods or published for subscription. + Identify any service level agreements and performance thresholds for the application. + Register and track whether an application is available to the public internet in a standard and continuously updated inventory. + Identify applications that support paid customers. | [[Allow Listing]] [[Application Decoys]] [[Attack Surface Enumeration]] [[Deny Listing]] [[Exploit Management]] [[Incident Management]] [[Resilience Testing]] | [[Bug Bounty]] [[Cyber Researcher]] [[Insider Threat]] [[Money Movers]] [[Nation State]] [[Script Kiddies]] [[Weaponizer]] | | **Application Lifecycle** | + The maturity and disposition of an application is captured in the application inventory. + The expected life of an application is document in the application inventory. + Applications are reviewed and the lifecycle is updated at least once per year. + Applications that have reached their end of life are deprecated and the identifier marked as retired. | [[Incident Management]] [[Resilience Testing]] | [[Script Kiddies]] | | **Application Monitoring** | + Applications are continuously monitored. + Behavioral baselines are established and provide the basis for service level thresholds. | [[Alert Correlation]] [[Case Management]] [[Resilience Testing]] | [[Bug Bounty]] [[Cyber Researcher]] [[Script Kiddies]] | | **Application Procurement** | + Identify needed features from outlined needs and requirements. | | [[Supply Chain]] | | **Application Risk Score** | + An Application Risk Score is documented and assigned to the application identifier which includes all attributable risks. | [[Adversary Intelligence]] [[Allow Listing]] [[Incident Management]] [[Remediation Management]] [[Resilience Testing]] | [[Cyber Researcher]] | | **Capability Map** Track business capabilities to govern investments | + Map business capabilities. + Assign applications to a business capability. | [[Attack Surface Enumeration]] | All | | **Defect Tracking** | + Defects are assigned to an application and tracked until remediated. + Defects are included in the Application Risk Score. + Defects are tracked against a specified and documented hygiene budget. | [[Remediation Management]] | [[Bug Bounty]] [[Cyber Researcher]] [[Insider Threat]] [[Script Kiddies]] | | **Dependency Tracking** | + Dependencies are assigned an identifier and included in the Application Inventory. + Dependency version is documented. + Dependencies are vetted and assigned a preference level. | [[Attack Surface Enumeration]] [[Exploit Management]] [[Incident Management]] | [[Bug Bounty]] [[Cyber Researcher]] [[Insider Threat]] [[Supply Chain]] | | **EOL (End of Life) Management** | | | [[Bug Bounty]] [[Cyber Researcher]] | | **Needs Assessment** Assess what level of automation is needed | + Conduct user interviews to identify automation needs. + Assess existing process steps and tasks to identify opportunities to increase efficiency through automation. + Outline any new opportunities for automation. | [[Persona Management]] | [[Insider Threat]] | | **Patch Management** | + Routinely patch applications to achieve remediation targets. | [[Asset Restoration]] | [[Bug Bounty]] [[Cyber Researcher]] [[Script Kiddies]] | | **Use Case Management** | + Track digitally assisted use cases. + Identify and document new use cases. + Use cases should be traced to a funded business capability goal. | [[Persona Management]] [[Defense Modeling]] | [[Bug Bounty]] [[Cyber Researcher]] | | **Version Tracking** | + Track all versions of software within the Application Inventory | [[Attack Surface Enumeration]] [[Resilience Testing]] | [[Bug Bounty]] [[Cyber Researcher]] | ## Metrics >[!cm-metric] Metric: [[% of Applications in Use]] >[!cm-metric] Metric: [[% of Expired Applications in Use]] > >[!cm-metric] Metric: [[% of Hygiene Budget used YoY]] ## Inspiration & Resources + [What is Application Management? | IBM](https://www.ibm.com/topics/application-management) + [Definition of Application Management - IT Glossary | Gartner](https://www.gartner.com/en/information-technology/glossary/application-management) + ## Release Notes + [[WIP - Q4 2024 Release#Develop Templates for sub-pages of Foundational Capabilities]] ## [Cyber City Map](https://cybercitymap.com/) © 2023-2024 by [ThirdScore, Inc.](https://thirdscore.com/) All Rights Reserved.