http://software-security.sans.org/blog/2016/05/06/2016-state-of-application-security-skills-configurations-and-components