Assessment of Application Security in Four Strategic Steps