Policy creation: who's in the driver's seat?

Your situation is pretty similar to the customers I was working with on ASM. I don't like the idea of app owners exclusively maintaining the policy. Management generally already places too much emphasis on functionality and new features over security. If there is no one outside them and the app owners to dictate security policy, you end up with very open, insecure implementations.

 

 

If you feel like publishing anonymized versions of any of your documentation or processes, I'm sure other ASM admins would appreciate it. I know a lot might be specific to your company, but I imagine a decent amount could go towards helping others establish best practices.

 

 

Aaron