Making ASVS Truly Your Own
summary
Shows how ASVS gets forked, edited as Markdown, and rebuilt with pandoc inside a Docker container to produce PDFs with clickable CWE links and derivation notices; converts the same source to JSON/XML for tooling, maps controls to internal policies, and wires requirements into Jira/Azure DevOps tickets for traceability. Describes using OSCAL-style catalogs and the Security Knowledge Framework, translating controls to Gherkin stories, reports adoption takes nontrivial effort but the build pipeline and templates like icefogel make maintaining sync and outputs practical.
AI-written summary · about
chapters (7)
- 0:00Introduction and context
- 3:04Understanding ASVS
- 10:16Adopting and modifying ASVS
- 16:41Adapting document formatting
- 25:59Technical implementation
- 34:26Modernizing compliance
- 45:21Q&A and closing
related talks
55mBuilding a sustainable security requirements process with the ASVS
39mIntroducing the ASVS 4.0
26mFlagship Projects: Security Knowledge Framework
38mLeveraging the ASVS in the Secure SDLC
45mWhat's New in ASVS V5
24mFlagship Projects: Application Security Verification Standard
45mLeveraging Projects and Tools to Transform Your SDLC
45mMaturing Your Application Security Program with ASVS-Driven Development