OWASP Projects and Application Security

OWASP Application Security Verification Standard

3.1.

ASVS Overview and Purpose

3.1.1.

Standardizing Security Requirements

3.1.2.

Supporting Security Testing

3.1.3.

Enabling Procurement Decisions

3.1.4.

Facilitating Security Training

3.2.

ASVS Architecture and Structure

3.2.1.

Verification Levels

3.2.1.1.

Level 1 Opportunistic

3.2.1.1.1.

Basic Security Controls

3.2.1.1.2.

Automated Testing Focus

3.2.1.1.3.

Minimum Security Baseline

3.2.1.2.

Level 2 Standard

3.2.1.2.1.

Comprehensive Security Controls

3.2.1.2.2.

Manual Testing Requirements

3.2.1.2.3.

Most Applications Target

3.2.1.3.

Level 3 Advanced

3.2.1.3.1.

High-Value Applications

3.2.1.3.2.

Comprehensive Manual Testing

3.2.1.3.3.

Advanced Security Controls

3.2.2.

Control Categories Overview

3.2.3.

Requirement Numbering System

3.2.4.

Control Applicability Guidelines

3.3.

ASVS Control Categories

3.3.1.

V1 Architecture Design and Threat Modeling

3.3.1.1.

Secure Development Lifecycle

3.3.1.2.

Architecture Documentation

3.3.1.3.

Threat Modeling Requirements

3.3.1.4.

Secure Design Principles

3.3.2.

V2 Authentication

3.3.2.1.

Password Authenticator Requirements

3.3.2.2.

General Authenticator Requirements

3.3.2.3.

Authenticator Lifecycle Requirements

3.3.2.4.

Credential Storage Requirements

3.3.3.

V3 Session Management

3.3.3.1.

Fundamental Session Management Requirements

3.3.3.2.

Session Binding Requirements

3.3.3.3.

Session Logout and Timeout Requirements

3.3.3.4.

Cookie-Based Session Management

3.3.3.5.

Token-Based Session Management

3.3.4.

V4 Access Control

3.3.4.1.

General Access Control Design

3.3.4.2.

Operation Level Access Control

3.3.4.3.

Other Access Control Considerations

3.3.5.

V5 Validation Sanitization and Encoding

3.3.5.1.

Input Validation Requirements

3.3.5.2.

Sanitization and Sandboxing Requirements

3.3.5.3.

Output Encoding and Injection Prevention Requirements

3.3.5.4.

Memory String and Unmanaged Code Requirements

3.3.5.5.

Deserialization Prevention Requirements

3.3.6.

V6 Stored Cryptography

3.3.6.1.

3.3.6.2.

3.3.6.3.

3.3.6.4.

3.3.6.5.

3.3.7.

V7 Error Handling and Logging

3.3.7.1.

Log Content Requirements

3.3.7.2.

Log Processing Requirements

3.3.7.3.

Log Protection Requirements

3.3.7.4.

Error Handling

3.3.8.

V8 Data Protection

3.3.8.1.

General Data Protection

3.3.8.2.

Client-Side Data Protection

3.3.8.3.

Sensitive Private Data

3.3.9.

V9 Communication

3.3.9.1.

Communications Security Requirements

3.3.9.2.

Server Communications Security Requirements

3.3.9.3.

Client Communications Security Requirements

3.3.10.

V10 Malicious Code

3.3.10.1.

Code Integrity Controls

3.3.10.2.

Malicious Code Search

3.3.10.3.

Deployed Application Integrity Controls

3.3.11.

V11 Business Logic

3.3.11.1.

Business Logic Security Requirements

3.3.11.2.

Anti-Automation

3.3.11.3.

File Upload Requirements

3.3.12.

V12 Files and Resources

3.3.12.1.

File Upload Requirements

3.3.12.2.

File Integrity Requirements

3.3.12.3.

File Execution Requirements

3.3.12.4.

File Storage Requirements

3.3.13.

V13 API and Web Service

3.3.13.1.

Generic Web Service Security Requirements

3.3.13.2.

RESTful Web Service

3.3.13.3.

SOAP Web Service

3.3.13.4.

GraphQL and other Web Service Data Layer Security Requirements

3.3.14.

V14 Configuration

3.3.14.1.

Build and Deploy

3.3.14.2.

Dependency

3.3.14.3.

Unintended Security Disclosure Requirements

3.3.14.4.

HTTP Security Headers Requirements

3.3.14.5.

Validate HTTP Request Header Requirements

2. OWASP Top 10 Web Application Security Risks

Go to top

4. OWASP Software Assurance Maturity Model