OWASP Projects and Application Security

  1. OWASP Application Security Verification Standard
    1. ASVS Overview and Purpose
      1. Standardizing Security Requirements
        1. Supporting Security Testing
          1. Enabling Procurement Decisions
            1. Facilitating Security Training
            2. ASVS Architecture and Structure
              1. Verification Levels
                1. Level 1 Opportunistic
                  1. Basic Security Controls
                    1. Automated Testing Focus
                      1. Minimum Security Baseline
                      2. Level 2 Standard
                        1. Comprehensive Security Controls
                          1. Manual Testing Requirements
                            1. Most Applications Target
                            2. Level 3 Advanced
                              1. High-Value Applications
                                1. Comprehensive Manual Testing
                                  1. Advanced Security Controls
                                2. Control Categories Overview
                                  1. Requirement Numbering System
                                    1. Control Applicability Guidelines
                                    2. ASVS Control Categories
                                      1. V1 Architecture Design and Threat Modeling
                                        1. Secure Development Lifecycle
                                          1. Architecture Documentation
                                            1. Threat Modeling Requirements
                                              1. Secure Design Principles
                                              2. V2 Authentication
                                                1. Password Authenticator Requirements
                                                  1. General Authenticator Requirements
                                                    1. Authenticator Lifecycle Requirements
                                                      1. Credential Storage Requirements
                                                      2. V3 Session Management
                                                        1. Fundamental Session Management Requirements
                                                          1. Session Binding Requirements
                                                            1. Session Logout and Timeout Requirements
                                                              1. Token-Based Session Management
                                                              2. V4 Access Control
                                                                1. General Access Control Design
                                                                  1. Operation Level Access Control
                                                                    1. Other Access Control Considerations
                                                                    2. V5 Validation Sanitization and Encoding
                                                                      1. Input Validation Requirements
                                                                        1. Sanitization and Sandboxing Requirements
                                                                          1. Output Encoding and Injection Prevention Requirements
                                                                            1. Memory String and Unmanaged Code Requirements
                                                                              1. Deserialization Prevention Requirements
                                                                              2. V6 Stored Cryptography
                                                                                1. Data Classification
                                                                                  1. Algorithms
                                                                                    1. Random Values
                                                                                      1. Secret Management
                                                                                        1. Stored Cryptography
                                                                                        2. V7 Error Handling and Logging
                                                                                          1. Log Content Requirements
                                                                                            1. Log Processing Requirements
                                                                                              1. Log Protection Requirements
                                                                                                1. Error Handling
                                                                                                2. V8 Data Protection
                                                                                                  1. General Data Protection
                                                                                                    1. Client-Side Data Protection
                                                                                                      1. Sensitive Private Data
                                                                                                      2. V9 Communication
                                                                                                        1. Communications Security Requirements
                                                                                                          1. Server Communications Security Requirements
                                                                                                            1. Client Communications Security Requirements
                                                                                                            2. V10 Malicious Code
                                                                                                              1. Code Integrity Controls
                                                                                                                1. Deployed Application Integrity Controls
                                                                                                                2. V11 Business Logic
                                                                                                                  1. Business Logic Security Requirements
                                                                                                                    1. Anti-Automation
                                                                                                                      1. File Upload Requirements
                                                                                                                      2. V12 Files and Resources
                                                                                                                        1. File Upload Requirements
                                                                                                                          1. File Integrity Requirements
                                                                                                                            1. File Execution Requirements
                                                                                                                              1. File Storage Requirements
                                                                                                                              2. V13 API and Web Service
                                                                                                                                1. Generic Web Service Security Requirements
                                                                                                                                  1. RESTful Web Service
                                                                                                                                    1. SOAP Web Service
                                                                                                                                      1. GraphQL and other Web Service Data Layer Security Requirements
                                                                                                                                      2. V14 Configuration
                                                                                                                                        1. Build and Deploy
                                                                                                                                          1. Dependency
                                                                                                                                            1. Unintended Security Disclosure Requirements
                                                                                                                                              1. HTTP Security Headers Requirements
                                                                                                                                                1. Validate HTTP Request Header Requirements

                                                                                                                                            Previous

                                                                                                                                            2. OWASP Top 10 Web Application Security Risks

                                                                                                                                            Go to top

                                                                                                                                            Next

                                                                                                                                            4. OWASP Software Assurance Maturity Model