How To Reduce Application Security Risk And Gain Assurance