Test in-house-developed and third-party-procured web applications for common security weaknesses using automated remote web application scanners prior to
deployment, whenever updates are made to the application, and on a regular recurring basis. Include tests for application behavior under denial-of-service or resource exhaustion attacks.