Getting benefits of OWASP ASVS at initial phases
summary
Adopts OWASP ASVS to turn vague risks into measurable requirements, mapping 183 controls into three levels so apps get level 1–3 security goals; authentication maps to 25 authentication controls (e.g., enforce server-side checks, invalidate sessions on logout) and PCI‑DSS scope narrows tests across 200–300 apps. Defines pass criteria for penetration tests, uses ASVS in scoping and rules of engagement, classifies login service = level 3 and cardholder client as level 2 or 3, and tracks updates via ASVS on GitHub.
AI-written summary · about
chapters (9)
- 0:00Introduction to security
- 1:26Security basics and standards
- 6:09OWASP Top 10 evaluation
- 10:37OWASP ASVS introduction
- 23:57Real-life implementation
- 27:16Automation and scoping
- 27:53Integrating security processes
- 33:14Conclusion
- 33:49Closing remarks
related talks
38mLeveraging the ASVS in the Secure SDLC
35mOWASP Application Security Verification Standard (ASVS)
39mIntroducing the ASVS 4.0
52mAppSec: From the OWASP Top Ten(s) to the OWASP ASVS
41mFrom the OWASP Top Ten(s) to the OWASP ASVS
55mBuilding a sustainable security requirements process with the ASVS
55mASVS Project
01h 02mFrom the OWASP Top Ten(s) to the OWASP ASVS