The hardest part of any good building project is laying a foundation and understanding what that foundation means. If you lay a square foundation, but attempting to build a triangular building well sure the foundation can support the building, but the foundation is either going to be to big or two small both have inherent issues. Defining the pillars of an App Security Program is much like laying the foundation. What do the pillars require? How many different ways do they need to support the app security program? Do I want a few big pillars from a high level or a few small narrowly scoped pillars?
more here...........http://security.howellsonline.ca/app-security-program-pillars/
more here...........http://security.howellsonline.ca/app-security-program-pillars/