Leveraging the ASVS in the Secure SDLC
summary
Cerner uses OWASP ASVS v3 verification statements, rewrites them into four control types (functional, process, DevOps, tech‑design), and produces ~240 controls that map to ASVS levels 1–3. An adapted modified Google VSAQ questionnaire determines an app’s target level and filters irrelevant controls, then automatically opens each control as a JIRA task. Teams mark controls as applicable, completed, or not applicable; reports track adherence, highlight common gaps, and surface prioritization so development can fix early rather than in production.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:57Background
- 2:45Importance of Security
- 4:28Solving defects early
- 5:00Named vulnerabilities in 2016
- 5:51Security
- 7:36Control
- 11:45Common Framework
- 13:28Domains
- 14:17Verification Statements
- 15:08Control vs Requirement
- 17:17Security Control Types
- 20:34B Sack
- 21:23Questionnaire
- 29:06Benefits
- 32:40Questions
related talks
35mGetting benefits of OWASP ASVS at initial phases
35mOWASP Application Security Verification Standard (ASVS)
45mMaturing Your Application Security Program with ASVS-Driven Development
39mIntroducing the ASVS 4.0
24mFlagship Projects: Application Security Verification Standard
55mBuilding a sustainable security requirements process with the ASVS
45mWhat's New in ASVS V5
52mAppSec: From the OWASP Top Ten(s) to the OWASP ASVS