Category:OWASP Application Security Verification Standard Project

From OWASP
Revision as of 09:06, 28 March 2014 by Jmanico (Talk | contribs)

Jump to: navigation, search
[edit]

Asvs-header.jpg

The primary aim of the OWASP Application Security Verification Standard (ASVS) Project is to normalize the range in the coverage and level of rigor available in the market when it comes to performing Web application security verification using a commercially-workable open standard. The standard provides a basis for testing application technical security controls, as well as any technical security controls in the environment, that are relied on to protect against vulnerabilities such as Cross-Site Scripting (XSS) and SQL injection. This standard can be used to establish a level of confidence in the security of Web applications. The requirements were developed with the following objectives in mind:

  • Use as a metric - Provide application developers and application owners with a yardstick with which to assess the degree of trust that can be placed in their Web applications,
  • Use as guidance - Provide guidance to security control developers as to what to build into security controls in order to satisfy application security requirements, and
  • Use during procurement - Provide a basis for specifying application security verification requirements in contracts.

Did you know...

Asvs-handshake.JPGASVS Users

A broad range of companies and agencies around the globe have added ASVS to their software assurance tool boxes, including Aspect Security, Astyran, Booz Allen Hamilton, Casaba Security, CGI Federal, Denim Group, Etebaran Informatics, Minded Security, Nixu, ps_testware, Proactive Risk, Quince Associates Limited (SeeMyData), Serviço Federal de Processamento de Dados (SERPRO), Universidad Distrital Francisco José de Caldas Organizations listed are not accredited by OWASP. Neither their products or services have been endorsed by OWASP. Use of ASVS may include for example providing verification services using the standard. Use of ASVS may also include for example performing internal evaluation of products with the OWASP ASVS in mind, and NOT making any claims of meeting any given level in the standard. Please let us know how your organization is using OWASP ASVS. Include your name, organization's name, and brief description of how you use the standard. The project lead can be reached here.

What is this?

The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls.

Email List

Asvs-bulb.jpg Project Email List

ASVS Translations

Asvs-writing.JPG

The ASVS project is always on the lookout for volunteers who are interested in translating ASVS into another language.

Related resources

Asvs-satellite.jpgOWASP Resources

News and Events

  • [March 27 2014] New Wiki Template!

Classifications

Owasp-flagship-trans-85.png Owasp-builders-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png
Project Type Files DOC.jpg

PROJECT INFO
What does this OWASP project offer you?
RELEASE(S) INFO
What releases are available for this project?
what is this project?
Name: OWASP Application Security Verification Standard Project (home page)
Purpose: The primary aim of the OWASP Application Security Verification Standard (ASVS) Project is to normalize the range in the coverage and level of rigour available in the market when it comes to performing Web application security verification using a commercially-workable open standard. The standard provides a basis for testing application technical security controls, as well as any technical security controls in the environment, that are relied on to protect against vulnerabilities such as Cross-Site Scripting (XSS) and SQL injection. This standard can be used to establish a level of confidence in the security of Web applications. The requirements were developed with the following objectives in mind:
  • Use as a metric - Provide application developers and application owners with a yardstick with which to assess the degree of trust that can be placed in their Web applications,
  • Use as guidance - Provide guidance to security control developers as to what to build into security controls in order to satisfy application security requirements, and
  • Use during procurement - Provide a basis for specifying application security verification requirements in contracts.
License: Creative Commons Attribution ShareAlike 3.0
who is working on this project?
Project Leader(s):
Project Contributor(s):
how can you learn more?
Project Pamphlet: View
Project Presentation: View
Mailing list: Mailing List Archives
Project Roadmap: Not Yet Created
Main links:
Key Contacts
  • Contact the GPC to report a problem or concern about this project or to update information.
current release
ASVS - 2009 Edition - 2009 - (download)
Release description: N/A
Rating: Greenlight.pngGreenlight.pngGreenlight.png Stable Release - Assessment Details
last reviewed release
ASVS - SoC 2008 Edition - 2008 - (download)
Release description: Beta Release
Rating: Greenlight.pngGreenlight.png Beta Release - Assessment Details


other releases