After significant vulnerabilities and misconfigurations were found in numerous production web applications, a security manager identified the need to implement better development controls.

Input validation routines are enforced on the server side.

Operating systems do not permit null sessions.

Systems administrators receive application security training.

VPN connections are terminated after a defined period of time.

Error-handling logic fails securely.

OCSP calls are handled effectively.