  The delivery of a framework in place for secure application development is of
real value for application development teams to integrate security into their
development life cycle, especially when a mobile or web application moves past
the scanning stage and focuses increasingly on the remediation or mitigation
phase based on static application security testing (SAST). For the first time,
to the author's knowledge, the industry-standard Open Web Application Security
Project (OWASP) top 10 vulnerabilities and CWE/SANS top 25 most dangerous
software errors are synced up in a matrix with Checkmarx vulnerability queries,
producing an application security framework that helps development teams review
and address code vulnerabilities, minimise false positives discovered in static
scans and penetration tests, targeting an increased accuracy of the findings. A
case study is conducted for vulnerabilities scanning of a proof-of-concept
mobile malware detection app. Mapping the OWASP/SANS with Checkmarx
vulnerabilities queries, flaws and vulnerabilities are demonstrated to be
mitigated with improved efficiency.
