building an application security program from scratch