Questions tagged [asvs]
Application Security Verification Standard (ASVS) is an OWASP project to provide guidance to security control developers and a basis for specifying security requirements.
12 questions
1
vote
1
answer
121
views
Automate ASVS with ZAP
I am new to this role. So I am trying to understand a few things.
My organisation wants to evaluate the existing application according to ASVS https://github.com/OWASP/ASVS/blob/master/4.0/docs_en/...
- 117
-1
votes
2
answers
286
views
Which standard can be used to seed security checklist for web application?
I am trying to create a security checklist for developers/testers of web applications to make sure that the web app is compliant with all the security guidelines.
When looking at the different ...
- 105
1
vote
1
answer
295
views
Do we need threat modelling after following ASVS standard?
We are planning to lay out guidelines in our organisation for everyone to follow a secure software development lifecycle. As part of this, we plan to adopt the security knowledge framework (SKF) that ...
- 111
2
votes
2
answers
814
views
Passwords verification against a set of breached passwords
NIST and OWASP ASVS recommends checking passwords against those obtained from previous data breaches. The list of such passwords can be downloaded from "Have I Been Pwned" (https://...
- 1,363
2
votes
1
answer
607
views
How to interpret "Verify the use of a secure software development lifecycle that addresses security in all stages of development"?
I've been looking at OWASP Application Security Verification Standard 4.0.2 for a while now, and I'm trying to understand all the checkpoints in detail.
I am not sure what exactly the author of a ...
- 23
0
votes
1
answer
243
views
What parameters can be used to configure context-sensitive authorisation?
I recognise that context-sensitive authorisation to applications is a good security control however I can currently only think of location being an example of a sensitive context.
I don't consider ...
- 539
0
votes
3
answers
6k
views
How should I interpret, "access controls on the presentation layer are enforced on the server side?
This question is with reference to the OWASP standard (Access control rules on the presentation layer are enforced on the server side - OWASP ASVS 3.0 - 4.9)
I'm trying to deeply understand what it ...
- 539
0
votes
1
answer
2k
views
What is an "appropriate" request size limit for a web service?
Point 18.4 of the OWASP ASVS says
Verify that all input is limited to an appropriate size limit.
Currently i have an input limit of 50MB on all web services. (And it seems like this is the ...
- 316
0
votes
0
answers
188
views
Recognized complement to OWASP's ASVS requirements
The OWASP ASVS focuses on web-application verification. It is free and recognised worldwide as a good reference to build upon, or simply reuse. It is useful to use it when outsourcing web development.
...
- 1,629
1
vote
2
answers
269
views
OWASP ASVS asking for client-side validation?
While perusing ASVS 3.0.1 I came across requirement V5.18:
Verify that client side validation is used as a second line of defense, in addition to server side validation.
Umm... is client-side ...
- 724
5
votes
1
answer
581
views
How relevant is OWASP ASVS? [closed]
How relevant is the OWASP application security verification standard? Have you had it as a requirement made by business? What other application security standards relevant to business are there? I did ...
- 163
4
votes
2
answers
2k
views
Why does OWASP ASVS require HTTP responses to have a content header specifying a character set?
The OWASP Application Security Verification Standard (ASVS), Version 3, states in clause V11.2:
Verify that every HTTP response contains a content type header specifying a safe character set (e.g., ...
- 724