Building a sustainable security requirements process with the ASVS
summary
Argues for using the OWASP ASVS as a requirements standard but not raw — fork the ASVS and trim it to context so 280 sprawling checks become a focused set (clients drop to ~10–15 relevant items per feature). Uses simple feature questions mapped to ASVS items, threat modeling to prioritize, and a central repo of implementation patterns (password library, output-encoding rules, headers via reverse proxy) so security becomes operationalized and repeatable with a single source of truth.
AI-written summary · about
chapters (11)
- 0:00Start
- 3:40What are the problems?
- 10:07What is the ASVS?
- 14:34Forking Do's and Don'ts
- 16:48Tailor to the organization
- 17:13Tailor to features
- 18:04Prebuilt, custom splits
- 23:06Quality attributes of software
- 34:03Tradeoffs - Perfect vs Good
- 37:42Security Backlog
- 40:02Security fragmentation
related talks
35mGetting benefits of OWASP ASVS at initial phases
39mHandling of Security Requirements in Software Development Lifecycle
45mMaturing Your Application Security Program with ASVS-Driven Development
55mASVS Project
24mFlagship Projects: Application Security Verification Standard
39mIntroducing the ASVS 4.0
34mMastering Security Requirements Engineering
20mSecure Software Development Lifecycle