2
votes
Automate ASVS with ZAP
There has been some work on this. You should check out this blog:
Automate checking ASVS controls using ZAP scripts
Basically, yes some of it can be done with ZAP and existing scan rules or additional ...
- 624
2
votes
Do we need threat modelling after following ASVS standard?
After adopting the ASVS standard do we need to perform threat-modelling?
Threat modeling is part of this framework. See section 1.1.2:
1.1.2 Verify the use of threat modeling for every design change ...
- 5,256
2
votes
Accepted
Passwords verification against a set of breached passwords
Do you recommend comparing users' passwords (during registration, password change, or even every successful login) with such a large list?
For reasonable security, I recommend to check passwords ...
- 34.4k
2
votes
Passwords verification against a set of breached passwords
"Every successful login" is pointless waste unless you just implemented the password-checking feature and didn't have it before, in which case it might make sense to check every user's login ...
- 52.2k
2
votes
How should I interpret, "access controls on the presentation layer are enforced on the server side?
It is simply reiterating the most basic rule of internet security - never trust anything from the client (aka presentation layer, aka browser, etc...). Since the "presentation layer" operates on an ...
- 31.7k
1
vote
Accepted
What is an "appropriate" request size limit for a web service?
This depends on what the webservice is doing.
I'd re-write this OWASP line to: "Verify that all input is limited to a size appropriate for the service".
So if you control the input you can set the ...
- 2,054
1
vote
Accepted
How to interpret "Verify the use of a secure software development lifecycle that addresses security in all stages of development"?
Section 1.1.1 refers to Proactive Controls Controls C1: Define Security Requirements
I think Section 1.1.1 can be considered as a high-level control for making sure SDLC procedure discovered and ...
- 26
1
vote
What parameters can be used to configure context-sensitive authorisation?
Context-sensative in this case just means that the context is take into account. It has nothing to do with location being a "sensative" or "secret" attribute.
There's a lot of potential contexts ...
- 5,160
1
vote
How should I interpret, "access controls on the presentation layer are enforced on the server side?
It's simply saying that any client-side validation controls must also be enforced server-side.
Client-side validation controls are more efficient, because they happen within the web session. However, ...
- 216
1
vote
How should I interpret, "access controls on the presentation layer are enforced on the server side?
An example would be where the server sends more data to the client than the client is intended to display to the user. Because the client can be manipulated in ways the server can't, you must assume ...
- 73.3k
Only top scored, non community-wiki answers of a minimum length are eligible