From the OWASP Top Ten(s) to the OWASP ASVS
summary
Asserts the OWASP Top Ten is only awareness and not a program and points to OWASP ASVS v4.0 as a concrete standard with 180+ requirements organized into levels 1–3 (level 1 testable by scanners/pen testers). Maps requirements to NIST 800-63 and CWEs, adds serverless/microservice and JWT guidance, mandates password storage via bcrypt scrypt Argon2, pushes hardware-backed secret vaults/HSMs, and prescribes CI/CD automation (SAST, DAST, SBOM). The standard is public on GitHub, reviewed by hundreds of comments and actively maintained.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 6:22ASVS
- 14:59The Team
- 15:54NIST 863
- 19:42Changes in web development
- 22:32Common Weakness Enumeration
- 23:16Standards Worth
- 24:11Levels of Severity
- 24:57DevOps
- 34:00What we removed
- 34:41Architecture
- 37:03Authentication
- 43:28Password Storage
- 45:38Session Management
- 49:58Input Validation
- 50:38Store Cryptography
- 51:43Data Protection
- 54:23Communication Security
- 58:45Business Logic Verification
- 59:31REST Security
related talks
52mAppSec: From the OWASP Top Ten(s) to the OWASP ASVS
41mFrom the OWASP Top Ten(s) to the OWASP ASVS
39mIntroducing the ASVS 4.0
43mFrom OWASP top 10 to Secure Applications
35mOWASP Application Security Verification Standard (ASVS)
55mASVS Project
35mGetting benefits of OWASP ASVS at initial phases
32mUsing the OWASP Top 10 As The Foundation for Security and Privacy Programs Across Your Organization