This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Category:OWASP Application Security Verification Standard Project"
Deleted user (talk | contribs) |
Deleted user (talk | contribs) |
||
| Line 56: | Line 56: | ||
<br> | <br> | ||
====Web Application Edition==== | ====Web Application Edition==== | ||
| − | '''OWASP ASVS - Beta (This is the current official release version)''' | + | '''Web Application Edition of OWASP ASVS - Beta (This is the current official release version)''' |
<br> | <br> | ||
[[Image:Beta_cover.JPG|thumb|90px|left|Beta Release]] | [[Image:Beta_cover.JPG|thumb|90px|left|Beta Release]] | ||
| Line 74: | Line 74: | ||
| − | '''OWASP ASVS Alpha Downloads''' | + | '''Web Application Edition of OWASP ASVS Alpha Downloads''' |
<br> | <br> | ||
[[Image:Alpha_cover.JPG|thumb|90px|left|Alpha Release]] | [[Image:Alpha_cover.JPG|thumb|90px|left|Alpha Release]] | ||
| Line 95: | Line 95: | ||
====Web Service Edition==== | ====Web Service Edition==== | ||
| − | ''' | + | '''Web Service Edition of ASVS - First release is under development''' |
| − | + | * Details will be filled in as work progresses. Volunteers wanted! | |
| − | + | * Contact [mailto:[email protected] Mike Boberski] for further details. | |
| − | + | ====Cloud Computing Edition==== | |
| − | + | '''Cloud Computing Edition of ASVS - First release is under development''' | |
| − | * | + | * Details will be filled in as work progresses. Volunteers wanted! |
| − | * | + | * Contact [mailto:boberski_michael@bah.com Mike Boberski] for further details. |
| − | + | ====Client Server Edition==== | |
| − | + | '''Client Server of ASVS - First release is under development''' | |
| − | + | * Details will be filled in as work progresses. Volunteers wanted! | |
| − | + | * Contact [mailto:[email protected] Mike Boberski] for further details. | |
| − | |||
| − | |||
| − | |||
| − | |||
| | | | ||
Revision as of 00:51, 21 March 2009
About
What is ASVS?
Whereas the OWASP Top Ten Project is a tool that provides web application security awareness, the OWASP "Application Security Verification Standard" (also known as "ASVS") is a commercially-workable open standard that defines ranges in coverage and levels of rigor that can be used to perform application security verifications. There are three main parts to ASVS. The requirements in ASVS define: levels of application-level security verification that increase in breadth and depth as one moves up the levels; verification requirements that prescribe a unique white-list approach for security controls; reporting requirements that ensure reports are sufficiently detailed to make verification repeatable, and to determine if the verification was accurate and complete. OWASP ASVS is the first standard that OWASP has published, and ASVS is the first internationally-recognized standard for performing application security assessments! There are currently versions in English.
Where did ASVS come from?
The OWASP ASVS project is led by Mike Boberski (Booz Allen Hamilton). The primary authors are Mike Boberski, Jeff Williams (Aspect Security), and Dave Wichers (Aspect Security). The ASVS is the result of the collection and consolidation of decades of collective subject matter expertise in application security. Please let us know how your organization is using ASVS. Include your name, organization's name, and brief description of how you use the standard. The project lead can be reached at [email protected] Thanks for supporting OWASP!
What's new?
OWASP ASVS was recently presented by Dave Wichers at OWASP Software Assurance Day DC 2009 in conjunction with the Software Assurance Forum sponsored by the US Department of Homeland Security, Department of Defense and National Institute of Standards and Technology. Project news can be found here. Articles about ASVS and how to use it can be found here.
FAQ
|
This project has produced a book that can be downloaded or purchased. Feel free to browse the full catalog of available OWASP books. |
More About OWASP ASVS
- Project Presentation (PowerPoint)
- Executive-Level Presentation (PowerPoint)
- Presentation Abstract (Word)
- One Page Datasheet (PDF, Word)
- Articles - More About ASVS and Using It
Related projects
Web Application Edition
Web Application Edition of OWASP ASVS - Beta (This is the current official release version)
Download free:
OWASP ASVS - Beta
Web Application Edition of OWASP ASVS Alpha Downloads
Download free:
OWASP ASVS - Alpha
Web Service Edition
Web Service Edition of ASVS - First release is under development
- Details will be filled in as work progresses. Volunteers wanted!
- Contact Mike Boberski for further details.
Cloud Computing Edition
Cloud Computing Edition of ASVS - First release is under development
- Details will be filled in as work progresses. Volunteers wanted!
- Contact Mike Boberski for further details.
Client Server Edition
Client Server of ASVS - First release is under development
- Details will be filled in as work progresses. Volunteers wanted!
- Contact Mike Boberski for further details.
News
Project News
- 03/13/2009 - OWASP ASVS is presented by Dave Wichers at OWASP Software Assurance Day DC 2009 in conjunction with the Software Assurance Forum sponsored by the US Department of Homeland Security, Department of Defense and National Institute of Standards and Technology.
- 02/25/2009 – OWASP ASVS proposed updates based on pilots being considered.
- 01/22/2009 - OWASP ASVS has been integrated into the OWASP Secure Software Contract Annex in the OWASP Legal Project.
- 01/08/2009 - OWASP ASVS is presented by Mike Boberski at the OWASP Washington VA Local Chapter meeting.
- 12/29/2008 - OWASP ASVS is the subject of an article by DarkReading.
- 12/08/2008 - OWASP ASVS Final assistance required! Please join the mailing list for more information and assignments.
- 12/05/2008 - OWASP ASVS exits the Summer of Code 2008! The Beta draft of the Web Application Edition is released! Mike Boberski, Jeff Williams, and Dave Wichers are the primary authors.
- 11/03/2008 - OWASP ASVS is presented by Jeff Williams at OWASP EU Summit 2008.
- 10/03/2008 - OWASP ASVS Alpha draft is released! Mike Boberski is the primary author.
- 04/16/2008 - OWASP ASVS Summer of Code 2008 proposal submitted by Mike Boberski wins!
Project Mail List
Subscribe here
Use here
Contributors/Users
Project Leader
Mike Boberski
Project Contributors
Jeff Williams
Dave Wichers
The OWASP ASVS project is co-sponsored by:
Users and Adopters
Pilots are already underway at various companies and agencies around the globe. A broad range of companies and agencies around the globe are also using OWASP ASVS, including:
- Aspect Security
- Booz Allen Hamilton
Please let us know how your organization is using OWASP ASVS. Include your name, organization's name, and brief description of how you use the standard. The project lead can be reached at [email protected] Thanks for supporting OWASP!
This project licensed under the Licensed under Creative Commons Attribution ShareAlike 3.0.
Articles Below - More About ASVS and Using It
Pages in category "OWASP Application Security Verification Standard Project"
The following 21 pages are in this category, out of 21 total.
H
- How to bootstrap the NIST risk management framework with verification activities
- How to bootstrap your SDLC with verification activities
- How to create verification project schedules
- How to perform a security architecture review at Level 1
- How to perform a security architecture review at Level 2
- How to specify verification requirements in contracts
- How to write verifier job requisitions
