https://blogs.sans.org/appsecstreetfighter/2016/05/06/2016-state-of-application-security-skills-configurations-and-components/