This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Mobile Security Testing Guide"

From OWASP
Jump to: navigation, search
(Acknowledgements)
(Main)
Line 70: Line 70:
  
 
[https://www.owasp.org/index.php/User:Milan_Singh_Thakur Milan Singh Thakur]
 
[https://www.owasp.org/index.php/User:Milan_Singh_Thakur Milan Singh Thakur]
 +
 +
== Road Map ==
 +
 +
* Q2 2017: Beta release
 +
* Q3 2017: Version 1.0
 +
* Q4 2017: Produce A Printable Book
  
 
== Parent Project ==
 
== Parent Project ==

Revision as of 05:03, 3 December 2016

OWASP MSTG Header.jpg

Our Vision

Create a comprehensive methodology that covers the processes, techniques, and tools used during a mobile app security test, and define a complete set of test cases that enables testers to deliver consistent and complete results.

At least, that was the initial vision. However, we soon discovered that we had to ask some deeper questions on what mobile app security is about: Without a reasonable definition a "secure" mobile app, there wasn't really anything to test against. We therefore went back to the drawing board and wrote the MASVS, a "mobile security standard" that defines the baseline security requirements.

Main Documents

Testing-guide-sample-mini.jpg Mobile AppSec Verification Standard (MASVS)

A standard for mobile app security. It is meant to be used by mobile software architects and developers seeking to develop secure mobile applications and as a basis for mobile app security testing methodologies. The MASVS lists requirements for both security controls and software protection mechanisms, and defines four verification levels that can be applied to achieve different grades of security and resiliency.

The MASVS is in a pre-release state. A (slightly outdated) PDF release is available. The most current set of requirements can be found in the master branch on GitHub.

Masvs-sample-mini.jpg Mobile Security Testing Guide (MSTG)

A comprehensive guide for iOS and Android mobile security testers that includes the following content:

  1. Mobile platform internals
  2. Testing in the secure development lifecycle
  3. Basic white-box and black-box security testing
  4. Mobile reverse engineering and tampering
  5. Assessing software protections
  6. 96 detailed test cases that map to the requirements in the MASVS.

The MSTG is an a pre-release state and not yet ready for release. Currently, we aim for a first pre-release in Q1 2017. You can however access the existing content in the GitHub Repo.

Checklist.jpg Mobile Security Testing Checklists

A basis of checklists will be made available in addition to the verification standard and testing guide.



Classifications

Owasp-breakers-small.png
Cc-button-y-sa-small.png
Project Type Files DOC.jpg

Project Leaders

Bernhard Mueller

Sven Schleier

Project Initiator

Milan Singh Thakur

Road Map

  • Q2 2017: Beta release
  • Q3 2017: Version 1.0
  • Q4 2017: Produce A Printable Book

Parent Project

OWASP_Mobile_Security_Project

Licensing

The guide is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.


How can I participate in your project?

First of all, read the author's guide and decide in what for you would like to contribute. Then, contact the lead author responsible for the chapter you are interested in. You can find their name and GitHub handle in the project README. Please always check with the responsible person first, or you might end up working on a chapter that's already being done by someone else. In any case, we encourage you to join OWASP Mobile Security Project Slack Channel, where you'll find all the other project members. You can sign up for an account here.

The home of the OWASP Mobile Security Testing Guide is on GitHub. You are encourged to fork, edit and push your changes back to the project through git or edit the project directly on github.

If I am not a programmer can I participate in your project?

Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.

I contributed to the original Google Doc, but I'm not credited in the new version of the MSTG?

As we migrated some of the existing content, we did our best to backtrack the original authors and credit them appropriately. We also added a revision history that lists all the authors from old Google Docs. If you are not on that list but feel you should be, please contact Bernhard or Sven and they'll fix it. Or better yet, re-join the author's team and start contributing to the new guide.

Contributors

The Mobile Security Testing Guide was initiated by Milan Singh Thakur in 2015. The original document was hosted on Google Drive. Guide development was moved to GitHub in October 2016. Below is the full list of contributors for each revision.

MSTG in its current form

Lead Authors:

  • Stephen Corbiaux
  • Bernhard Mueller
  • Sven Schleier
  • Francesco Stillavato
  • Stefan Streichsbier
  • Abdessamad Temmar
  • Stephanie Vanroelen
  • Gerhard Wagner
  • Jeroen Willemsen

Contributors:

  • Davide Cioccia
  • Bao Le
  • Shiv Patel
  • Prathan Phongthiproek
  • Abhinav Sejpal
  • Anant Shrivastava
  • Pragati Singh
  • Milan Singh Thakur
  • Blessen Thomas
  • Dennis Titze
  • Bernard Wagner

MSTG "Beta 2" on Google Drive

Authors:

  • Mirza Ali
  • Stephen Corbiaux
  • Ryan Dewhurst
  • Mohammad Hamed Dadpour
  • David Fern
  • Bao Lee
  • Anto Joseph
  • Nutan Kumar Panda
  • Rahil Parikh
  • Julian Schütte
  • Abhinav Sejpal
  • Anant Shrivastava
  • Pragati Singh
  • Milan Singh Thakur
  • Stephanie Vanroelen
  • Gerhard Wagner

Reviewers:

  • Andrew Muller
  • Jonathan Carter
  • Stephanie Vanroelen
  • Milan Singh Thakur

MSTG "Beta 1" on Google Drive

Authors:

  • Mirza Ali
  • Mohammad Hamed Dadpour
  • David Fern
  • Rahil Parikh
  • Abhinav Sejpal
  • Pragati Singh
  • Milan Singh Thakur

Reviewers:

  • Andrew Muller
  • Jonathan Carter

Top Contributors:

  • Jim Manico
  • Yair Amit
  • Amin Lalji
  • OWASP Mobile Team