Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Asvs v4 developers and founders
Similar to Asvs v4 developers and founders (20)
Recently uploaded
Recently uploaded (20)
Asvs v4 developers and founders
- 1. OWASP ASVS V.4 for Startup Founders and Developers Hemed Gur Ary 22 May 2019
- 4. Sponsors
- 5. OWASP Sydney • What is OWASP anyway? • Sydney is a new formal chapter • Character will depend on volunteers
- 6. Sydney Leaders Reece Stewart Head Of Business Development Alcorn Group Hemi Gur Ary CTO VATA
- 7. ASVS Project Overview • Application Security Verification Standard project provides a basis for testing web application technical security controls
- 8. ASVS Structure • About • What’s new • Using the ASVS (Levels) • Requirements • Appendices
- 9. Requirements • Architecture, Design and Threat Modeling • Authentication • Session Management • Access Control • Validation, Sanitization and Encoding • Stored Cryptography • Error Handling and Logging • Data Protection • Communications • Malicious Code • Deployed Application Integrity • Business Logic • File and Resources • API and Web Service
- 10. We are here because • Security is important • We want to learn about OWASP ASVS • We want our lives to be easier as… • We …
- 11. More Benefits Founder Developer Business Enablement Career Boost Investing in your technological savings Reduce chatter around security Proactively secure your start up Proactively secure your application Minimizing security costs in development and incidents An intelligent security discussion An intelligent security discussion
- 12. ASVS Project Goal • Standardise security verification in a practical way OWASP Top 10 does not achieve this goal
- 13. Pen testing soft spot
- 14. OWASP Top Ten Limitations • Awareness tool • High Level • Lists vulnerabilities and not requirements • Not inclusive
- 15. ASVS strong points • Specific, Measurable, Achievable, Realistic, Time • Can be used across organisations • Aligned with OWASP Top 10 and CWE
- 16. Practical Uses For Founders • Internal application security policy • Security Assurance for customers and investors • Contractual clauses with suppliers
- 17. Practical Uses For Developers • Map to secure an application from start to end • Learning tool • Testing use case
- 18. Takeaways • ASVS understanding • Practical uses • Ideas to volunteer with OWASP