Category:OWASP Application Security Verification Standard Project

Application Security Verification Standard 3.0

• ASVS 3.0 in English

(download PDF - 1.2 MB)

• ASVS 3.0 excel sheet

(download XLSX - 39 kB)

We are looking for translators for this version. If you can help us, please contact the project mail list!

Legacy Application Security Verification Standard 2.0 (final)

• ASVS 2.0 in English (download PDF - 1.6 MB)
• ASVS 2.0 in English (download Word - 1.0MB)
• ASVS 2.0 in Persian (download PDF - 1.6MB)

Volunteers

Version 3 (2015)

Project Leaders

• Daniel Cuthbert
• Andrew van der Stock

Lead Author

• Jim Manico

Other reviewers and contributors

• Boy Baukema
• Ari Kesäniemi
• Colin Watson
• François-Eric Guyomarc’h
• Cristinel Dumitru
• James Holland
• Gary Robinson
• Stephen de Vries
• Glenn Ten Cate
• Riccardo Ten Cate
• Martin Knobloch
• Abhinav Sejpal
• David Ryan
• Steven van der Baan
• Ryan Dewhurst
• Raoul Endres
• Roberto Martelloni

Version 2 (2014)

Project leaders

• Sahba Kazerooni
• Daniel Cuthbert

Lead authors

• Andrew van der Stock
• Sahba Kazerooni
• Daniel Cuthbert
• Krishna Raja

Other reviewers and contributors

• Jerome Athias
• Boy Baukema
• Archangel Cuison
• Sebastien.Deleersnyder
• Antonio Fontes
• Evan Gaustad
• Safuat Hamdy
• Ari Kesäniemi
• Scott Luc
• Jim Manico
• Mait Peekma
• Pekka Sillanpää
• Jeff Sergeant
• Etienne Stalmans
• Colin Watson
• Dr. Emin İslam Tatlı

Translators

• Abbas Javan Jafari (Persian)
• Sajjad Pourali (Persian)

Version 2009

Project leader

• Mike Boberski

Lead authors

• Mike Boberski
• Jeff Williams
• Dave Wichers

Other reviewers and contributors

Pierre Parrend (OWASP Summer of Code), Andrew van der Stock, Nam Nguyen, John Martin, Gaurang Shah, Theodore Winograd, Stan Wisseman, Barry Boyd, Steve Coyle, Paul Douthit, Ken Huang, Dave Hausladen, Mandeep Khera Scott Matsumoto, John Steven, Stephen de Vries, Dan Cornell, Shouvik Bardhan, Dr. Sarbari Gupta, Eoin Keary, Richard Campbell, Matt Presson, Jeff LoSapio, Liz Fong, George Lawless, Dave van Stein, Terrie Diaz, Ketan Dilipkumar Vyas, Bedirhan Urgun, Dr. Thomas Braun, Colin Watson, Jeremiah Grossman.

OWASP Summer of Code 2008

The OWASP Foundation sponsored the OWASP Application Security Verification Standard Project during the OWASP Summer of Code 2008.

ASVS Terminology

• Access Control – A means of restricting access to files, referenced functions, URLs, and data based on the identity of users and/or groups to which they belong.
• Application Component – An individual or group of source files, libraries, and/or executables, as defined by the verifier for a particular application.
• Application Security – Application-level security focuses on the analysis of components that comprise the application layer of the Open Systems Interconnection Reference Model (OSI Model), rather than focusing on for example the underlying operating system or connected networks.
• Application Security Verification – The technical assessment of an application against the OWASP ASVS.
• Application Security Verification Report – A report that documents the overall results and supporting analysis produced by the verifier for a particular application.
• Application Security Verification Standard (ASVS) – An OWASP standard that defines four levels of application security verification for applications.
• Authentication – The verification of the claimed identity of an application user.
• Automated Verification – The use of automated tools (either dynamic analysis tools, static analysis tools, or both) that use vulnerability signatures to find problems.
• Back Doors – A type of malicious code that allows unauthorized access to an application.
• Blacklist – A list of data or operations that are not permitted, for example a list of characters that are not allowed as input.
• Common Criteria (CC) – A multipart standard that can be used as the basis for the verification of the design and implementation of security controls in IT products.
• Communication Security – The protection of application data when it is transmitted between application components, between clients and servers, and between external systems and the application.
• Design Verification – The technical assessment of the security architecture of an application.
• Internal Verification – The technical assessment of specific aspects of the security architecture of an application as defined in the OWASP ASVS.
• Cryptographic module – Hardware, software, and/or firmware that implements cryptographic algorithms and/or generates cryptographic keys.
• Denial of Service (DOS) Attacks – The flooding of an application with more requests than it can handle.
• Dynamic Verification – The use of automated tools that use vulnerability signatures to find problems during the execution of an application.
• Easter Eggs – A type of malicious code that does not run until a specific user input event occurs.
• External Systems – A server-side application or service that is not part of the application.
• FIPS 140-2 – A standard that can be used as the basis for the verification of the design and implementation of cryptographic modules
• Input Validation – The canonicalization and validation of untrusted user input.
• Malicious Code – Code introduced into an application during its development unbeknownst to the application owner which circumvents the application’s intended security policy. Not the same as malware such as a virus or worm!
• Malware – Executable code that is introduced into an application during runtime without the knowledge of the application user or administrator.
• Open Web Application Security Project (OWASP) – The Open Web Application Security Project (OWASP) is a worldwide free and open community focused on improving the security of application software. Our mission is to make application security "visible," so that people and organizations can make informed decisions about application security risks. See: http://www.owasp.org/
• Output Validation – The canonicalization and validation of application output to Web browsers and to external systems.
• OWASP Enterprise Security API (ESAPI) – A free and open collection of all the security methods that developers need to build secure Web applications. See: http://www.owasp.org/index.php/ESAPI
• OWASP Risk Rating Methodology – A risk rating methodology that has been customized for application security. See: http://www.owasp.org/index.php/How_to_value_the_real_risk
• OWASP Testing Guide – A document designed to help organizations understand what comprises a testing program, and to help them identify the steps needed to build and operate that testing program. See: http://www.owasp.org/index.php/Category:OWASP_Testing_Project
• OWASP Top Ten – A document that represents a broad consensus about what the most critical Web application security flaws are. See: http://www.owasp.org/index.php/Top10
• Positive – See whitelist.
• Salami Attack – A type of malicious code that is used to redirect small amounts of money without detection in financial transactions.
• Security Architecture – An abstraction of an application’s design that identifies and describes where and how security controls are used, and also identifies and describes the location and sensitivity of both user and application data.
• Security Control – A function or component that performs a security check (e.g. an access control check) or when called results in a security effect (e.g. generating an audit record).
• Security Configuration – The runtime configuration of an application that affects how security controls are used.
• Static Verification – The use of automated tools that use vulnerability signatures to find problems in application source code.
• Target of Verification (TOV) – If you are performing an application security verification according to the OWASP ASVS requirements, the verification will be of a particular application. This application is called the "Target of Verification" or simply the TOV.
• Threat Modeling - A technique consisting of developing increasingly refined security architectures to identify threat agents, security zones, security controls, and important technical and business assets.
• Time Bomb – A type of malicious code that does not run until a preconfigured time or date elapses.
• Verifier - The person or team that is reviewing an application against the OWASP ASVS requirements.
• Whitelist – A list of permitted data or operations, for example a list of characters that are allowed to perform input validation.

A broad range of companies and agencies around the globe have added ASVS to their software assurance tool boxes, including Aspect Security, Astyran, Booz Allen Hamilton, Casaba Security, CGI Federal, Denim Group, Etebaran Informatics, Minded Security, Nixu, ps_testware, Proactive Risk, Quince Associates Limited (SeeMyData), Serviço Federal de Processamento de Dados (SERPRO), Universidad Distrital Francisco José de Caldas Organizations listed are not accredited by OWASP. Neither their products or services have been endorsed by OWASP. Use of ASVS may include for example providing verification services using the standard. Use of ASVS may also include for example performing internal evaluation of products with the OWASP ASVS in mind, and NOT making any claims of meeting any given level in the standard. Please let us know how your organization is using OWASP ASVS. Include your name, organization's name, and brief description of how you use the standard. The project lead can be reached here.

PI-0001: Are there levels between the levels?

• Issue: Are there levels between the levels for the cases where "The specification for an application may require OWASP ASVS Level N, but it could also include other additional detailed requirements such as from a higher ASVS level"?
• Resolution: No. Use of alternate level definitions or notations such as "ASVS Level 1B+" is discouraged.
• References: ASVS section "Application Security Verification Levels"

PI-0002: Is use of a master key simply another level of indirection?

• Issue: If a master key is stored as plaintext, isn't using a master key simply another level of indirection?
• Resolution: No. There is a strong rationale for having a "master key" stored in a secure location that is used to encrypt all other secrets. In many applications, there are lots of secrets stored in many different locations. This greatly increases the likelihood that one of them will be compromised. Having a single master key makes managing the protection considerably simpler and is not simply a level of indirection.
• References: ASVS verification requirement V2.14

PI-0003: What is a "TOV" or "Target of Verification"?

• Issue: New terminology
• Resolution: If you are performing an application security verification according to ASVS, the verification will be of a particular application. This application is called the "Target of Verification" or simply the TOV. The TOV should be identified in verification documentation as follows:
  • TOV Identification – <name and version of the application> or <Application name>, <application version>, dynamic testing was performed in a staging environment, not the production environment
  • TOV Developer – <insert name of the developer or verification customer>
• References: ASVS section "Approach"

If you can help with translations, please download the latest draft here:

https://github.com/OWASP/ASVS

If there are any incomprehensible English idiom or phrases in there, please don't hesitate to ask for clarification, because if it's hard to translate, it's almost certainly wrong in English as well. We recommend logging translation issues in GitHub, too, so please make yourself known.

Translations are coordinated through OWASP's Crowd In account, so you don't have to do the entire thing yourself.

https://crowdin.com/project/owasp-asvs/

You don't HAVE to use Crowd In, but it would be nice to indicate to other native speakers of your language that you are willing to work together. This is a 70 page document, and in all honesty, will take a dedicated person a week or more to translate, so please please please work together rather than apart. You have full access to the original document and the original images, so you have everything I have.

*Please note that ASVS is currently on version 3.0. The information on this page is for archival purposes only.*

'1. About ASVS 1.0'

• Video presentation in English (YouTube)
• ASVS vs. WASC et al (Wiki)

'2. Get ASVS 1.0'

• ASVS in Bahasa Indonesia (Indonesian language) (PDF)
• ASVS in Bahasa Malaysia (Malay) (Currently under development!)
• ASVS in Chinese(Currently under development!)
• ASVS in English (PDF, Word, Online, XML)
• ASVS in French (PDF, OpenOffice)
• ASVS in German (PDF, Word)
• ASVS in Hungarian (Currently under development!)
• ASVS in Japanese (PDF, Word)
• ASVS in Persian (Farsi) (PDF) beta 0.7
• ASVS in Polish (PDF)
• ASVS in Portuguese-Brazil (PDF)
• ASVS in Spanish (Currently under development!)
• ASVS in Thai (Currently under development!)

'3. Learn ASVS 1.0'

• ASVS Article: Getting Started Using ASVS (PDF)
• ASVS Article: Code Reviews and Other Verification Activities: USELESS Unless Acted Upon IMMEDIATELY (Wiki)
• ASVS Article: Agile Software Development: Don't Forget EVIL User Stories (Wiki)
• ASVS Article: Man vs. Code (Wiki)
• ASVS Article: Getting started designing for a level of assurance (PDF)
• ASVS Template: Sample verification fee schedule template (Excel)
• ASVS Template: Sample verification report template (Word)
• ASVS Training: An ASVS training presentation (PowerPoint)
• ASVS Presentation: Executive-Level Presentation (PowerPoint)
• ASVS Presentation: Presentation Abstract (Word)
• Articles (More About ASVS and Using It)