https://www.sans.org/reading-room/whitepapers/bestprac/2016-state-application-security-skills-configurations-components-36917