SlideShare a Scribd company logo

ASVS 5.0 - The rise of the Security Verification Standard

•
•
T
TuynNguyn819213

1. The document discusses the OWASP Application Security Verification Standard (ASVS) which aims to provide requirements for securing applications and be used as an actual security standard. 2. The ASVS is designed to address limitations of other awareness documents and provide comprehensive and practical security requirements organized into three levels. 3. The speaker discusses how the ASVS is being adopted by organizations and assessment companies to help structure application security testing and control documentation. 4. Looking ahead, key principles for the upcoming ASVS 5.0 release focus on clarifying requirements, enhancing explanations of levels, and streamlining the main document to improve usability.

Engineering
1 of 47
Josh Grossman ASVS 5.0 – The rise of the Security Verification Standard Bounce Security and ASVS project co-leader
Josh Grossman ASVS 5.0 - The rise of the Security Verification Standard Bounce Security and ASVS project co-leader
Josh Grossman ■ Over 15 years of IT and Application Security, IT Risk and development experience ■ CTO for Bounce Security, value- driven Application Security support ■ Consulting and training for clients internationally and locally ■ Contact: – @JoshCGrossman – josh@bouncesecurity.com – https://joshcgrossman.com/ – https://appsecg.host – ■ OWASP Israel Chapter Board ■ Co-leader of the OWASP ASVS Project ■ Major Contributor to the OWASP Top Ten Proactive Controls project ■ Contributor to: – OWASP Top 10 Risks – OWASP JuiceShop
Today, I will be mostly discussing… Background to the ASVS 01 What is the OWASP ASVS? 02 What is the plan for version 5.0? 03 How are we seeing it used in industry? 04 How you can you use it and get involved? 05 @JoshCGrossman 4 | ASVS 5.0 - The rise of the Security Verification Standard
BACKGROUND SO, WHAT IS THE ASVS?
Quiz time! You tell me! (Vote with your hands) • Who has heard of the ASVS? • Who has used the ASVS? • Who uses it on an ongoing basis? • Who knows by heart what section V2 is called? • Authentication ☺ • Who can tell me by heart what v4.0.3-2.5.2 says? @JoshCGrossman 6 | ASVS 5.0 - The rise of the Security Verification Standard
BACKGROUND SO, WHAT IS THE ASVS?
SO, WHAT IS THE ASVS? WELL FIRST, WHAT ISN’T THE ASVS
The OWASP Top 10 Risks – The Good • Released every 3-4 years • Led by security experts from around the world - Andrew van der Stock, Neil Smithline, Torsten Gigler, Brian Glas • Public comments and conversation on 2017/2021 choices • Frequently cited • Application security awareness document @JoshCGrossman 9 | ASVS 5.0 - The rise of the Security Verification Standard
The OWASP Top 10 Risks – The Less Good • Spread awareness regarding Web Security issues. • It is not a standard. - Take note, PCI-DSS and others who incorrectly list it as one. • Not a comprehensive list • Bringing problems, not solutions @JoshCGrossman 10 | ASVS 5.0 - The rise of the Security Verification Standard
OWASP Top Ten Proactive Controls • Guidance document • Developer/builder focused Validate All Inputs 05 Define Security Requirements 01 Leverage Security Frameworks and Libraries 02 Secure Database Access 03 Encode and Escape Data 04 Handle All Errors and Exceptions 10 Implement Digital Identity 06 Enforce Access Controls 07 Protect Data Everywhere 08 Implement Security Logging and Monitoring 09 @JoshCGrossman 11 | ASVS 5.0 - The rise of the Security Verification Standard
Top Ten Proactive Controls – The Good • A great starting point • Gives practical prevention details • Also a great team: - Katy Anton, Jim Manico, Jim Bird @JoshCGrossman 12 | ASVS 5.0 - The rise of the Security Verification Standard
Top Ten Proactive Controls – The Less Good • Still not comprehensive • Again, more for awareness • Not organized as a standard @JoshCGrossman 13 | ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 14 | So, watcha gonna do? ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 15 | The OWASP ASVS! ASVS 5.0 - The rise of the Security Verification Standard
WHAT IS THE ASVS SO, WHAT IS THE ASVS?
What is the ASVS? • Requirements for a secure application • Designed to be an actual standard • Set of leading practices • Community and practitioner driven • Developed in the open • Split into 3 levels of requirement @JoshCGrossman 17 | ASVS 5.0 - The rise of the Security Verification Standard
More about ASVS 4.0.3 • Not going to cover today • See my previous talk 😊 https://appsecg.host/asvs @JoshCGrossman 18 | ASVS 5.0 - The rise of the Security Verification Standard
INDUSTRY Use of the ASVS in industry
Use of the ASVS in industry • Develop Secure Requirements • Design Security Checklist • Guidelines for Implementation • Map security properties of a security mechanism • … • Verification Standard @JoshCGrossman 20 | ASVS 5.0 - The rise of the Security Verification Standard
Not this verification! @JoshCGrossman 21 | ASVS 5.0 - The rise of the Security Verification Standard
VERIFICATION Verifying the security of an App
What about our usual AppSec verification? Penetration Testing Considered Harmful, Haroon Meer - 44CON 2011 https://www.youtube.com/watch?v=GvX52HPAfBk https://thinkst.com/resources/slides/44con-final.pdf @JoshCGrossman 23 | ASVS 5.0 - The rise of the Security Verification Standard
What about our usual AppSec verification? Penetration Testing Considered Harmful, Haroon Meer - 44CON 2011 https://www.youtube.com/watch?v=GvX52HPAfBk https://thinkst.com/resources/slides/44con-final.pdf @JoshCGrossman 24 | ASVS 5.0 - The rise of the Security Verification Standard
We can do better….can we? @JoshCGrossman 25 | ASVS 5.0 - The rise of the Security Verification Standard
Various suggestions, including: @JoshCGrossman 26 | ASVS 5.0 - The rise of the Security Verification Standard
So, what about AppSec? @JoshCGrossman 27 | ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 28 | Challenges for OWASP 1. How can OWASP remain neutral? 2. How can we drive adoption of standard? 3. How do we know the tester is competent? ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 29 | Case Study 1 - CREST OVS • Defines a standard for performing application security assessments • Based around Levels 1 and 2 of ASVS and MASVS • Intended to result in standardized and comparable reports • % of revenue will be donated back to OWASP • Announced in Summer 2022 ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 30 | CREST OVS - Response to challenges 1. How can OWASP remain neutral? • OWASP defines the standards, CREST does the rest (in consultation with OWASP). • No exclusivity 2. How can we drive adoption of standard? • CREST have experience in getting assessment standards adopted in industry 3. How do we know the tester is competent? • CREST have experience in accrediting testers ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 31 | Case Study 2 – Other industry group • Oversee a large ecosystem of applications • Applications go through some form of ASVS/MASVS based assessment • Type depends on application “impact” • Needs to be scalable ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 32 | Large tech company - Other industry group 1. How can OWASP remain neutral? ▪ OWASP defines the standards, Industry group does the rest (in consultation with OWASP). ▪ No exclusivity 2. How can we drive adoption of standard? ▪ Industry members control the ecosystem 3. How do we know the tester is competent? ▪ Open problem... ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 33 | Other outstanding challenges 4. Usability of standard 5. Scope of standard 6. Scalability of standard ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 34 | Other outstanding challenges 4. Usability of standard • We are planning release 5.0 5. Scope of standard • Let us know in the issues! 6. Scalability of standard • Open problem... ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 35 | ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 36 | Key principles for 5.0 Making it easier to use by: • Clarifying existing requirements and adding new ones based on community feedback • Enhance explanations on the levels and reduce the barrier to entry • Clean up mappings • Streamline the main document ASVS 5.0 - The rise of the Security Verification Standard
ACTION Calls to action
@JoshCGrossman 38 | 1) Get ready for Verification! • Expect ASVS/MASVS assessments based in the future • Application Penetration Testers: Can you start structuring your testing around the *SVS? • Application Developers: Can you structure your control documentation based on *SVS? ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 39 | Jim Manico NAME SURNAME Elar Lang Daniel Cuthbert NAME SURNAME Andrew Van der Stock NAME SURNAME Josh Grossman 2) Help with version 5.0 But we need you too!!! ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 40 | • Submit issues/change suggestions • Submit general feedback • Comment on other people's issues https://github.com/OWASP/ASVS/issues https://github.com/OWASP/ASVS/blob/master/CONTRIBUTING.md 2) Help with version 5.0 ASVS 5.0 - The rise of the Security Verification Standard
https://xkcd.com/2347/ @JoshCGrossman 41 | 3) Support the standard https://xkcd.com/2347/ ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 42 | 3) Support the standard Thanks to our supporters! ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 43 | 3) Support the standard ASVS 5.0 - The rise of the Security Verification Standard
@JoshCGrossman 44 | • Get ready for Verification! • Help with version 5.0 • Support the standard Summary ASVS 5.0 - The rise of the Security Verification Standard
45 | Whilst I have you…
46 | Whilst I have you… Tel Aviv, May 2023 Tell your friends! Tell your employers! https://appsecil.org/ @OWASP_IL
THANK YOU! ASVS Project @OWASP_ASVS https://github.com/OWASP/ASVS https://owasp.slack.com, #project-asvs https://owasp.org/asvs Josh Grossman josh.grossman@owasp.org josh@bouncesecurity.com @JoshCGrossman Any Questions? Thanks to Michal Kamensky for help with the slides

Recommended

Application Security Verification Standard Project
Application Security Verification Standard ProjectApplication Security Verification Standard Project
Application Security Verification Standard ProjectNarudom Roongsiriwong, CISSP
 
SQL Server Exploitation, Escalation, Pilfering - AppSec USA 2012
SQL Server Exploitation, Escalation, Pilfering - AppSec USA 2012SQL Server Exploitation, Escalation, Pilfering - AppSec USA 2012
SQL Server Exploitation, Escalation, Pilfering - AppSec USA 2012Scott Sutherland
 
Derbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active DirectoryDerbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active DirectoryWill Schroeder
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Frameworkn|u - The Open Security Community
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentTeymur Kheirkhabarov
 
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does ItAMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does ItNikhil Mittal
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CKArpan Raval
 
Introducing log analysis to your organization
Introducing log analysis to your organization Introducing log analysis to your organization
Introducing log analysis to your organization Sematext Group, Inc.
 

Recommended

Application Security Verification Standard Project
Application Security Verification Standard ProjectApplication Security Verification Standard Project
Application Security Verification Standard ProjectNarudom Roongsiriwong, CISSP
 
SQL Server Exploitation, Escalation, Pilfering - AppSec USA 2012
SQL Server Exploitation, Escalation, Pilfering - AppSec USA 2012SQL Server Exploitation, Escalation, Pilfering - AppSec USA 2012
SQL Server Exploitation, Escalation, Pilfering - AppSec USA 2012Scott Sutherland
 
Derbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active DirectoryDerbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active DirectoryWill Schroeder
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Frameworkn|u - The Open Security Community
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentTeymur Kheirkhabarov
 
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does ItAMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does ItNikhil Mittal
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CKArpan Raval
 
Introducing log analysis to your organization
Introducing log analysis to your organization Introducing log analysis to your organization
Introducing log analysis to your organization Sematext Group, Inc.
 
Chapter 4
Chapter 4Chapter 4
Chapter 4Amy McMullin
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentTeymur Kheirkhabarov
 
BloodHound: Attack Graphs Practically Applied to Active Directory
BloodHound: Attack Graphs Practically Applied to Active DirectoryBloodHound: Attack Graphs Practically Applied to Active Directory
BloodHound: Attack Graphs Practically Applied to Active DirectoryAndy Robbins
 
Sql injection with sqlmap
Sql injection with sqlmapSql injection with sqlmap
Sql injection with sqlmapHerman Duarte
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...MITRE ATT&CK
 
Web application security
Web application securityWeb application security
Web application securityKapil Sharma
 
"Hunting the Bad Guys: Using OSINT, Social Media & other tools within Splunk"
"Hunting the Bad Guys: Using OSINT, Social Media & other tools within Splunk""Hunting the Bad Guys: Using OSINT, Social Media & other tools within Splunk"
"Hunting the Bad Guys: Using OSINT, Social Media & other tools within Splunk"Rinaldi Rampen
 
Mapping ATT&CK Techniques to ENGAGE Activities
Mapping ATT&CK Techniques to ENGAGE ActivitiesMapping ATT&CK Techniques to ENGAGE Activities
Mapping ATT&CK Techniques to ENGAGE ActivitiesMITRE ATT&CK
 
aclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHoundaclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHoundDirkjanMollema
 
Agile security
Agile securityAgile security
Agile securityArthur Donkers
 
Splunk App for Stream
Splunk App for StreamSplunk App for Stream
Splunk App for StreamSplunk
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureSergey Soldatov
 
Evading Microsoft ATA for Active Directory Domination
Evading Microsoft ATA for Active Directory DominationEvading Microsoft ATA for Active Directory Domination
Evading Microsoft ATA for Active Directory DominationNikhil Mittal
 
OSI Layer Security
OSI Layer SecurityOSI Layer Security
OSI Layer SecurityNurkholish Halim
 
When Insiders ATT&CK!
When Insiders ATT&CK!When Insiders ATT&CK!
When Insiders ATT&CK!MITRE ATT&CK
 
OSINT for Proactive Defense - RootConf 2019
OSINT for Proactive Defense - RootConf 2019OSINT for Proactive Defense - RootConf 2019
OSINT for Proactive Defense - RootConf 2019RedHunt Labs
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Kangaroot
 
SEC599 - Breaking The Kill Chain
SEC599 - Breaking The Kill ChainSEC599 - Breaking The Kill Chain
SEC599 - Breaking The Kill ChainErik Van Buggenhout
 
Windows splunk logging cheat sheet Oct 2016 - MalwareArchaeology.com
Windows splunk logging cheat sheet Oct 2016 - MalwareArchaeology.comWindows splunk logging cheat sheet Oct 2016 - MalwareArchaeology.com
Windows splunk logging cheat sheet Oct 2016 - MalwareArchaeology.comMichael Gough
 
Forcepoint Dynamic Data Protection
Forcepoint Dynamic Data ProtectionForcepoint Dynamic Data Protection
Forcepoint Dynamic Data ProtectionMarketingArrowECS_CZ
 
Web Application Security Strategy
Web Application Security Strategy Web Application Security Strategy
Web Application Security Strategy Network Intelligence India
 
Dealing with Web Application Security, Regulation Style
Dealing with Web Application Security, Regulation StyleDealing with Web Application Security, Regulation Style
Dealing with Web Application Security, Regulation StyleRochester Security Summit
 

More Related Content

What's hot

Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentTeymur Kheirkhabarov
 
BloodHound: Attack Graphs Practically Applied to Active Directory
BloodHound: Attack Graphs Practically Applied to Active DirectoryBloodHound: Attack Graphs Practically Applied to Active Directory
BloodHound: Attack Graphs Practically Applied to Active DirectoryAndy Robbins
 
Sql injection with sqlmap
Sql injection with sqlmapSql injection with sqlmap
Sql injection with sqlmapHerman Duarte
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...MITRE ATT&CK
 
Web application security
Web application securityWeb application security
Web application securityKapil Sharma
 
"Hunting the Bad Guys: Using OSINT, Social Media & other tools within Splunk"
"Hunting the Bad Guys: Using OSINT, Social Media & other tools within Splunk""Hunting the Bad Guys: Using OSINT, Social Media & other tools within Splunk"
"Hunting the Bad Guys: Using OSINT, Social Media & other tools within Splunk"Rinaldi Rampen
 
Mapping ATT&CK Techniques to ENGAGE Activities
Mapping ATT&CK Techniques to ENGAGE ActivitiesMapping ATT&CK Techniques to ENGAGE Activities
Mapping ATT&CK Techniques to ENGAGE ActivitiesMITRE ATT&CK
 
aclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHoundaclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHoundDirkjanMollema
 
Splunk App for Stream
Splunk App for StreamSplunk App for Stream
Splunk App for StreamSplunk
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureSergey Soldatov
 
Evading Microsoft ATA for Active Directory Domination
Evading Microsoft ATA for Active Directory DominationEvading Microsoft ATA for Active Directory Domination
Evading Microsoft ATA for Active Directory DominationNikhil Mittal
 
When Insiders ATT&CK!
When Insiders ATT&CK!When Insiders ATT&CK!
When Insiders ATT&CK!MITRE ATT&CK
 
OSINT for Proactive Defense - RootConf 2019
OSINT for Proactive Defense - RootConf 2019OSINT for Proactive Defense - RootConf 2019
OSINT for Proactive Defense - RootConf 2019RedHunt Labs
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Kangaroot
 
SEC599 - Breaking The Kill Chain
SEC599 - Breaking The Kill ChainSEC599 - Breaking The Kill Chain
SEC599 - Breaking The Kill ChainErik Van Buggenhout
 
Windows splunk logging cheat sheet Oct 2016 - MalwareArchaeology.com
Windows splunk logging cheat sheet Oct 2016 - MalwareArchaeology.comWindows splunk logging cheat sheet Oct 2016 - MalwareArchaeology.com
Windows splunk logging cheat sheet Oct 2016 - MalwareArchaeology.comMichael Gough
 
Forcepoint Dynamic Data Protection
Forcepoint Dynamic Data ProtectionForcepoint Dynamic Data Protection
Forcepoint Dynamic Data ProtectionMarketingArrowECS_CZ
 

What's hot (20)

Chapter 4
Chapter 4Chapter 4
Chapter 4
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
 
BloodHound: Attack Graphs Practically Applied to Active Directory
BloodHound: Attack Graphs Practically Applied to Active DirectoryBloodHound: Attack Graphs Practically Applied to Active Directory
BloodHound: Attack Graphs Practically Applied to Active Directory
 
Sql injection with sqlmap
Sql injection with sqlmapSql injection with sqlmap
Sql injection with sqlmap
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
 
Web application security
Web application securityWeb application security
Web application security
 
"Hunting the Bad Guys: Using OSINT, Social Media & other tools within Splunk"
"Hunting the Bad Guys: Using OSINT, Social Media & other tools within Splunk""Hunting the Bad Guys: Using OSINT, Social Media & other tools within Splunk"
"Hunting the Bad Guys: Using OSINT, Social Media & other tools within Splunk"
 
Mapping ATT&CK Techniques to ENGAGE Activities
Mapping ATT&CK Techniques to ENGAGE ActivitiesMapping ATT&CK Techniques to ENGAGE Activities
Mapping ATT&CK Techniques to ENGAGE Activities
 
aclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHoundaclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHound
 
Agile security
Agile securityAgile security
Agile security
 
Splunk App for Stream
Splunk App for StreamSplunk App for Stream
Splunk App for Stream
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows Infrastructure
 
Evading Microsoft ATA for Active Directory Domination
Evading Microsoft ATA for Active Directory DominationEvading Microsoft ATA for Active Directory Domination
Evading Microsoft ATA for Active Directory Domination
 
OSI Layer Security
OSI Layer SecurityOSI Layer Security
OSI Layer Security
 
When Insiders ATT&CK!
When Insiders ATT&CK!When Insiders ATT&CK!
When Insiders ATT&CK!
 
OSINT for Proactive Defense - RootConf 2019
OSINT for Proactive Defense - RootConf 2019OSINT for Proactive Defense - RootConf 2019
OSINT for Proactive Defense - RootConf 2019
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)
 
SEC599 - Breaking The Kill Chain
SEC599 - Breaking The Kill ChainSEC599 - Breaking The Kill Chain
SEC599 - Breaking The Kill Chain
 
Windows splunk logging cheat sheet Oct 2016 - MalwareArchaeology.com
Windows splunk logging cheat sheet Oct 2016 - MalwareArchaeology.comWindows splunk logging cheat sheet Oct 2016 - MalwareArchaeology.com
Windows splunk logging cheat sheet Oct 2016 - MalwareArchaeology.com
 
Forcepoint Dynamic Data Protection
Forcepoint Dynamic Data ProtectionForcepoint Dynamic Data Protection
Forcepoint Dynamic Data Protection
 

Similar to ASVS 5.0 - The rise of the Security Verification Standard

Dealing with Web Application Security, Regulation Style
Dealing with Web Application Security, Regulation StyleDealing with Web Application Security, Regulation Style
Dealing with Web Application Security, Regulation StyleRochester Security Summit
 
OWASP Top 10 - 2017The Ten Most Critical Web Application Sec.docx
OWASP Top 10 - 2017The Ten Most Critical Web Application Sec.docxOWASP Top 10 - 2017The Ten Most Critical Web Application Sec.docx
OWASP Top 10 - 2017The Ten Most Critical Web Application Sec.docxgerardkortney
 
A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020
A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020
A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020Brian Levine
 
Owasp top 10-2017
Owasp top 10-2017Owasp top 10-2017
Owasp top 10-2017malvvv
 
Owasp top 10 2017 (en)
Owasp top 10 2017 (en)Owasp top 10 2017 (en)
Owasp top 10 2017 (en)PrashantDhakol
 
OWASP_Top_10-2017_(en).pdf.pdf
OWASP_Top_10-2017_(en).pdf.pdfOWASP_Top_10-2017_(en).pdf.pdf
OWASP_Top_10-2017_(en).pdf.pdfSamSepiolRhodes
 
[OWASP Poland Day] Embedding security into SDLC + GDPR
[OWASP Poland Day] Embedding security into SDLC + GDPR[OWASP Poland Day] Embedding security into SDLC + GDPR
[OWASP Poland Day] Embedding security into SDLC + GDPROWASP
 
In that case, we have an OWASP Top 10 opportunity...
In that case, we have an OWASP Top 10 opportunity...In that case, we have an OWASP Top 10 opportunity...
In that case, we have an OWASP Top 10 opportunity...Josh Grossman
 
Application Portfolio Risk Ranking: Banishing FUD With Structure and Numbers
Application Portfolio Risk Ranking: Banishing FUD With Structure and NumbersApplication Portfolio Risk Ranking: Banishing FUD With Structure and Numbers
Application Portfolio Risk Ranking: Banishing FUD With Structure and NumbersDenim Group
 
Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2
Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2
Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2NetSPI
 
[1.1] Почему вам стоит поучаствовать в жизни OWASP Russia - Александр Антух
[1.1] Почему вам стоит поучаствовать в жизни OWASP Russia - Александр Антух[1.1] Почему вам стоит поучаствовать в жизни OWASP Russia - Александр Антух
[1.1] Почему вам стоит поучаствовать в жизни OWASP Russia - Александр АнтухOWASP Russia
 
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...Denim Group
 
Security Metrics Rehab: Breaking Free from Top ‘X’ Lists, Cultivating Organic...
Security Metrics Rehab: Breaking Free from Top ‘X’ Lists, Cultivating Organic...Security Metrics Rehab: Breaking Free from Top ‘X’ Lists, Cultivating Organic...
Security Metrics Rehab: Breaking Free from Top ‘X’ Lists, Cultivating Organic...EC-Council
 
HouSecCon 2019: Offensive Security - Starting from Scratch
HouSecCon 2019: Offensive Security - Starting from ScratchHouSecCon 2019: Offensive Security - Starting from Scratch
HouSecCon 2019: Offensive Security - Starting from ScratchSpencer Koch
 
PCI and Vulnerability Assessments - What’s Missing?
PCI and Vulnerability Assessments - What’s Missing?PCI and Vulnerability Assessments - What’s Missing?
PCI and Vulnerability Assessments - What’s Missing?Black Duck by Synopsys
 
Perforce on Tour 2015 - Grab Testing By the Horns and Move
Perforce on Tour 2015 - Grab Testing By the Horns and MovePerforce on Tour 2015 - Grab Testing By the Horns and Move
Perforce on Tour 2015 - Grab Testing By the Horns and MovePerforce
 

Similar to ASVS 5.0 - The rise of the Security Verification Standard (20)

Web Application Security Strategy
Web Application Security Strategy Web Application Security Strategy
Web Application Security Strategy
 
Dealing with Web Application Security, Regulation Style
Dealing with Web Application Security, Regulation StyleDealing with Web Application Security, Regulation Style
Dealing with Web Application Security, Regulation Style
 
OWASP Top 10 - 2017The Ten Most Critical Web Application Sec.docx
OWASP Top 10 - 2017The Ten Most Critical Web Application Sec.docxOWASP Top 10 - 2017The Ten Most Critical Web Application Sec.docx
OWASP Top 10 - 2017The Ten Most Critical Web Application Sec.docx
 
A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020
A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020
A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020
 
Owasp top 10-2017
Owasp top 10-2017Owasp top 10-2017
Owasp top 10-2017
 
Owasp top 10 2017 (en)
Owasp top 10 2017 (en)Owasp top 10 2017 (en)
Owasp top 10 2017 (en)
 
OWASP_Top_10-2017_(en).pdf.pdf
OWASP_Top_10-2017_(en).pdf.pdfOWASP_Top_10-2017_(en).pdf.pdf
OWASP_Top_10-2017_(en).pdf.pdf
 
Owasp Top 10
Owasp Top 10Owasp Top 10
Owasp Top 10
 
[OWASP Poland Day] Embedding security into SDLC + GDPR
[OWASP Poland Day] Embedding security into SDLC + GDPR[OWASP Poland Day] Embedding security into SDLC + GDPR
[OWASP Poland Day] Embedding security into SDLC + GDPR
 
In that case, we have an OWASP Top 10 opportunity...
In that case, we have an OWASP Top 10 opportunity...In that case, we have an OWASP Top 10 opportunity...
In that case, we have an OWASP Top 10 opportunity...
 
Application Portfolio Risk Ranking: Banishing FUD With Structure and Numbers
Application Portfolio Risk Ranking: Banishing FUD With Structure and NumbersApplication Portfolio Risk Ranking: Banishing FUD With Structure and Numbers
Application Portfolio Risk Ranking: Banishing FUD With Structure and Numbers
 
Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2
Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2
Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2
 
[1.1] Почему вам стоит поучаствовать в жизни OWASP Russia - Александр Антух
[1.1] Почему вам стоит поучаствовать в жизни OWASP Russia - Александр Антух[1.1] Почему вам стоит поучаствовать в жизни OWASP Russia - Александр Антух
[1.1] Почему вам стоит поучаствовать в жизни OWASP Russia - Александр Антух
 
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...
 
Security Metrics Rehab: Breaking Free from Top ‘X’ Lists, Cultivating Organic...
Security Metrics Rehab: Breaking Free from Top ‘X’ Lists, Cultivating Organic...Security Metrics Rehab: Breaking Free from Top ‘X’ Lists, Cultivating Organic...
Security Metrics Rehab: Breaking Free from Top ‘X’ Lists, Cultivating Organic...
 
HouSecCon 2019: Offensive Security - Starting from Scratch
HouSecCon 2019: Offensive Security - Starting from ScratchHouSecCon 2019: Offensive Security - Starting from Scratch
HouSecCon 2019: Offensive Security - Starting from Scratch
 
PCI and Vulnerability Assessments - What’s Missing?
PCI and Vulnerability Assessments - What’s Missing?PCI and Vulnerability Assessments - What’s Missing?
PCI and Vulnerability Assessments - What’s Missing?
 
Perforce on Tour 2015 - Grab Testing By the Horns and Move
Perforce on Tour 2015 - Grab Testing By the Horns and MovePerforce on Tour 2015 - Grab Testing By the Horns and Move
Perforce on Tour 2015 - Grab Testing By the Horns and Move
 
Application Hackers Have A Handbook. Why Shouldn't You?
Application Hackers Have A Handbook. Why Shouldn't You?Application Hackers Have A Handbook. Why Shouldn't You?
Application Hackers Have A Handbook. Why Shouldn't You?
 
Institute of Internal Auditors Presentation 2014
Institute of Internal Auditors Presentation 2014Institute of Internal Auditors Presentation 2014
Institute of Internal Auditors Presentation 2014
 

Recently uploaded

AKTU Computer Networks notes --- Unit 3.pdf
AKTU Computer Networks notes --- Unit 3.pdfAKTU Computer Networks notes --- Unit 3.pdf
AKTU Computer Networks notes --- Unit 3.pdfankushspencer015
 
UNIT-V FMM.HYDRAULIC TURBINE - Construction and working
UNIT-V FMM.HYDRAULIC TURBINE - Construction and workingUNIT-V FMM.HYDRAULIC TURBINE - Construction and working
UNIT-V FMM.HYDRAULIC TURBINE - Construction and workingrknatarajan
 
High Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur Escorts
High Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur EscortsHigh Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur Escorts
High Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur EscortsCall Girls in Nagpur High Profile
 
result management system report for college project
result management system report for college projectresult management system report for college project
result management system report for college projectTonystark477637
 
Structural Analysis and Design of Foundations: A Comprehensive Handbook for S...
Structural Analysis and Design of Foundations: A Comprehensive Handbook for S...Structural Analysis and Design of Foundations: A Comprehensive Handbook for S...
Structural Analysis and Design of Foundations: A Comprehensive Handbook for S...Dr.Costas Sachpazis
 
Online banking management system project.pdf
Online banking management system project.pdfOnline banking management system project.pdf
Online banking management system project.pdfKamal Acharya
 
The Most Attractive Pune Call Girls Budhwar Peth 8250192130 Will You Miss Thi...
The Most Attractive Pune Call Girls Budhwar Peth 8250192130 Will You Miss Thi...The Most Attractive Pune Call Girls Budhwar Peth 8250192130 Will You Miss Thi...
The Most Attractive Pune Call Girls Budhwar Peth 8250192130 Will You Miss Thi...ranjana rawat
 
Coefficient of Thermal Expansion and their Importance.pptx
Coefficient of Thermal Expansion and their Importance.pptxCoefficient of Thermal Expansion and their Importance.pptx
Coefficient of Thermal Expansion and their Importance.pptxAsutosh Ranjan
 
MANUFACTURING PROCESS-II UNIT-2 LATHE MACHINE
MANUFACTURING PROCESS-II UNIT-2 LATHE MACHINEMANUFACTURING PROCESS-II UNIT-2 LATHE MACHINE
MANUFACTURING PROCESS-II UNIT-2 LATHE MACHINESIVASHANKAR N
 
Processing & Properties of Floor and Wall Tiles.pptx
Processing & Properties of Floor and Wall Tiles.pptxProcessing & Properties of Floor and Wall Tiles.pptx
Processing & Properties of Floor and Wall Tiles.pptxpranjaldaimarysona
 
Call Girls in Nagpur Suman Call 7001035870 Meet With Nagpur Escorts
Call Girls in Nagpur Suman Call 7001035870 Meet With Nagpur EscortsCall Girls in Nagpur Suman Call 7001035870 Meet With Nagpur Escorts
Call Girls in Nagpur Suman Call 7001035870 Meet With Nagpur EscortsCall Girls in Nagpur High Profile
 
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...ranjana rawat
 
(ANJALI) Dange Chowk Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(ANJALI) Dange Chowk Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...(ANJALI) Dange Chowk Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(ANJALI) Dange Chowk Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...ranjana rawat
 
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdfONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdfKamal Acharya
 
College Call Girls Nashik Nehal 7001305949 Independent Escort Service Nashik
College Call Girls Nashik Nehal 7001305949 Independent Escort Service NashikCollege Call Girls Nashik Nehal 7001305949 Independent Escort Service Nashik
College Call Girls Nashik Nehal 7001305949 Independent Escort Service NashikCall Girls in Nagpur High Profile
 
University management System project report..pdf
University management System project report..pdfUniversity management System project report..pdf
University management System project report..pdfKamal Acharya
 
MANUFACTURING PROCESS-II UNIT-1 THEORY OF METAL CUTTING
MANUFACTURING PROCESS-II UNIT-1 THEORY OF METAL CUTTINGMANUFACTURING PROCESS-II UNIT-1 THEORY OF METAL CUTTING
MANUFACTURING PROCESS-II UNIT-1 THEORY OF METAL CUTTINGSIVASHANKAR N
 

Recently uploaded (20)

AKTU Computer Networks notes --- Unit 3.pdf
AKTU Computer Networks notes --- Unit 3.pdfAKTU Computer Networks notes --- Unit 3.pdf
AKTU Computer Networks notes --- Unit 3.pdf
 
UNIT-V FMM.HYDRAULIC TURBINE - Construction and working
UNIT-V FMM.HYDRAULIC TURBINE - Construction and workingUNIT-V FMM.HYDRAULIC TURBINE - Construction and working
UNIT-V FMM.HYDRAULIC TURBINE - Construction and working
 
High Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur Escorts
High Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur EscortsHigh Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur Escorts
High Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur Escorts
 
result management system report for college project
result management system report for college projectresult management system report for college project
result management system report for college project
 
Structural Analysis and Design of Foundations: A Comprehensive Handbook for S...
Structural Analysis and Design of Foundations: A Comprehensive Handbook for S...Structural Analysis and Design of Foundations: A Comprehensive Handbook for S...
Structural Analysis and Design of Foundations: A Comprehensive Handbook for S...
 
Online banking management system project.pdf
Online banking management system project.pdfOnline banking management system project.pdf
Online banking management system project.pdf
 
The Most Attractive Pune Call Girls Budhwar Peth 8250192130 Will You Miss Thi...
The Most Attractive Pune Call Girls Budhwar Peth 8250192130 Will You Miss Thi...The Most Attractive Pune Call Girls Budhwar Peth 8250192130 Will You Miss Thi...
The Most Attractive Pune Call Girls Budhwar Peth 8250192130 Will You Miss Thi...
 
Water Industry Process Automation & Control Monthly - April 2024
Water Industry Process Automation & Control Monthly - April 2024Water Industry Process Automation & Control Monthly - April 2024
Water Industry Process Automation & Control Monthly - April 2024
 
Coefficient of Thermal Expansion and their Importance.pptx
Coefficient of Thermal Expansion and their Importance.pptxCoefficient of Thermal Expansion and their Importance.pptx
Coefficient of Thermal Expansion and their Importance.pptx
 
DJARUM4D - SLOT GACOR ONLINE | SLOT DEMO ONLINE
DJARUM4D - SLOT GACOR ONLINE | SLOT DEMO ONLINEDJARUM4D - SLOT GACOR ONLINE | SLOT DEMO ONLINE
DJARUM4D - SLOT GACOR ONLINE | SLOT DEMO ONLINE
 
MANUFACTURING PROCESS-II UNIT-2 LATHE MACHINE
MANUFACTURING PROCESS-II UNIT-2 LATHE MACHINEMANUFACTURING PROCESS-II UNIT-2 LATHE MACHINE
MANUFACTURING PROCESS-II UNIT-2 LATHE MACHINE
 
Processing & Properties of Floor and Wall Tiles.pptx
Processing & Properties of Floor and Wall Tiles.pptxProcessing & Properties of Floor and Wall Tiles.pptx
Processing & Properties of Floor and Wall Tiles.pptx
 
(INDIRA) Call Girl Aurangabad Call Now 8617697112 Aurangabad Escorts 24x7
(INDIRA) Call Girl Aurangabad Call Now 8617697112 Aurangabad Escorts 24x7(INDIRA) Call Girl Aurangabad Call Now 8617697112 Aurangabad Escorts 24x7
(INDIRA) Call Girl Aurangabad Call Now 8617697112 Aurangabad Escorts 24x7
 
Call Girls in Nagpur Suman Call 7001035870 Meet With Nagpur Escorts
Call Girls in Nagpur Suman Call 7001035870 Meet With Nagpur EscortsCall Girls in Nagpur Suman Call 7001035870 Meet With Nagpur Escorts
Call Girls in Nagpur Suman Call 7001035870 Meet With Nagpur Escorts
 
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
 
(ANJALI) Dange Chowk Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(ANJALI) Dange Chowk Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...(ANJALI) Dange Chowk Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(ANJALI) Dange Chowk Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
 
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdfONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
 
College Call Girls Nashik Nehal 7001305949 Independent Escort Service Nashik
College Call Girls Nashik Nehal 7001305949 Independent Escort Service NashikCollege Call Girls Nashik Nehal 7001305949 Independent Escort Service Nashik
College Call Girls Nashik Nehal 7001305949 Independent Escort Service Nashik
 
University management System project report..pdf
University management System project report..pdfUniversity management System project report..pdf
University management System project report..pdf
 
MANUFACTURING PROCESS-II UNIT-1 THEORY OF METAL CUTTING
MANUFACTURING PROCESS-II UNIT-1 THEORY OF METAL CUTTINGMANUFACTURING PROCESS-II UNIT-1 THEORY OF METAL CUTTING
MANUFACTURING PROCESS-II UNIT-1 THEORY OF METAL CUTTING
 

ASVS 5.0 - The rise of the Security Verification Standard

  • 1. Josh Grossman ASVS 5.0 – The rise of the Security Verification Standard Bounce Security and ASVS project co-leader
  • 2. Josh Grossman ASVS 5.0 - The rise of the Security Verification Standard Bounce Security and ASVS project co-leader
  • 3. Josh Grossman ■ Over 15 years of IT and Application Security, IT Risk and development experience ■ CTO for Bounce Security, value- driven Application Security support ■ Consulting and training for clients internationally and locally ■ Contact: – @JoshCGrossman – josh@bouncesecurity.com – https://joshcgrossman.com/ – https://appsecg.host – ■ OWASP Israel Chapter Board ■ Co-leader of the OWASP ASVS Project ■ Major Contributor to the OWASP Top Ten Proactive Controls project ■ Contributor to: – OWASP Top 10 Risks – OWASP JuiceShop
  • 4. Today, I will be mostly discussing… Background to the ASVS 01 What is the OWASP ASVS? 02 What is the plan for version 5.0? 03 How are we seeing it used in industry? 04 How you can you use it and get involved? 05 @JoshCGrossman 4 | ASVS 5.0 - The rise of the Security Verification Standard
  • 6. Quiz time! You tell me! (Vote with your hands) • Who has heard of the ASVS? • Who has used the ASVS? • Who uses it on an ongoing basis? • Who knows by heart what section V2 is called? • Authentication ☺ • Who can tell me by heart what v4.0.3-2.5.2 says? @JoshCGrossman 6 | ASVS 5.0 - The rise of the Security Verification Standard
  • 8. SO, WHAT IS THE ASVS? WELL FIRST, WHAT ISN’T THE ASVS
  • 9. The OWASP Top 10 Risks – The Good • Released every 3-4 years • Led by security experts from around the world - Andrew van der Stock, Neil Smithline, Torsten Gigler, Brian Glas • Public comments and conversation on 2017/2021 choices • Frequently cited • Application security awareness document @JoshCGrossman 9 | ASVS 5.0 - The rise of the Security Verification Standard
  • 10. The OWASP Top 10 Risks – The Less Good • Spread awareness regarding Web Security issues. • It is not a standard. - Take note, PCI-DSS and others who incorrectly list it as one. • Not a comprehensive list • Bringing problems, not solutions @JoshCGrossman 10 | ASVS 5.0 - The rise of the Security Verification Standard
  • 11. OWASP Top Ten Proactive Controls • Guidance document • Developer/builder focused Validate All Inputs 05 Define Security Requirements 01 Leverage Security Frameworks and Libraries 02 Secure Database Access 03 Encode and Escape Data 04 Handle All Errors and Exceptions 10 Implement Digital Identity 06 Enforce Access Controls 07 Protect Data Everywhere 08 Implement Security Logging and Monitoring 09 @JoshCGrossman 11 | ASVS 5.0 - The rise of the Security Verification Standard
  • 12. Top Ten Proactive Controls – The Good • A great starting point • Gives practical prevention details • Also a great team: - Katy Anton, Jim Manico, Jim Bird @JoshCGrossman 12 | ASVS 5.0 - The rise of the Security Verification Standard
  • 13. Top Ten Proactive Controls – The Less Good • Still not comprehensive • Again, more for awareness • Not organized as a standard @JoshCGrossman 13 | ASVS 5.0 - The rise of the Security Verification Standard
  • 14. @JoshCGrossman 14 | So, watcha gonna do? ASVS 5.0 - The rise of the Security Verification Standard
  • 15. @JoshCGrossman 15 | The OWASP ASVS! ASVS 5.0 - The rise of the Security Verification Standard
  • 16. WHAT IS THE ASVS SO, WHAT IS THE ASVS?
  • 17. What is the ASVS? • Requirements for a secure application • Designed to be an actual standard • Set of leading practices • Community and practitioner driven • Developed in the open • Split into 3 levels of requirement @JoshCGrossman 17 | ASVS 5.0 - The rise of the Security Verification Standard
  • 18. More about ASVS 4.0.3 • Not going to cover today • See my previous talk 😊 https://appsecg.host/asvs @JoshCGrossman 18 | ASVS 5.0 - The rise of the Security Verification Standard
  • 19. INDUSTRY Use of the ASVS in industry
  • 20. Use of the ASVS in industry • Develop Secure Requirements • Design Security Checklist • Guidelines for Implementation • Map security properties of a security mechanism • … • Verification Standard @JoshCGrossman 20 | ASVS 5.0 - The rise of the Security Verification Standard
  • 21. Not this verification! @JoshCGrossman 21 | ASVS 5.0 - The rise of the Security Verification Standard
  • 23. What about our usual AppSec verification? Penetration Testing Considered Harmful, Haroon Meer - 44CON 2011 https://www.youtube.com/watch?v=GvX52HPAfBk https://thinkst.com/resources/slides/44con-final.pdf @JoshCGrossman 23 | ASVS 5.0 - The rise of the Security Verification Standard
  • 24. What about our usual AppSec verification? Penetration Testing Considered Harmful, Haroon Meer - 44CON 2011 https://www.youtube.com/watch?v=GvX52HPAfBk https://thinkst.com/resources/slides/44con-final.pdf @JoshCGrossman 24 | ASVS 5.0 - The rise of the Security Verification Standard
  • 25. We can do better….can we? @JoshCGrossman 25 | ASVS 5.0 - The rise of the Security Verification Standard
  • 26. Various suggestions, including: @JoshCGrossman 26 | ASVS 5.0 - The rise of the Security Verification Standard
  • 27. So, what about AppSec? @JoshCGrossman 27 | ASVS 5.0 - The rise of the Security Verification Standard
  • 28. @JoshCGrossman 28 | Challenges for OWASP 1. How can OWASP remain neutral? 2. How can we drive adoption of standard? 3. How do we know the tester is competent? ASVS 5.0 - The rise of the Security Verification Standard
  • 29. @JoshCGrossman 29 | Case Study 1 - CREST OVS • Defines a standard for performing application security assessments • Based around Levels 1 and 2 of ASVS and MASVS • Intended to result in standardized and comparable reports • % of revenue will be donated back to OWASP • Announced in Summer 2022 ASVS 5.0 - The rise of the Security Verification Standard
  • 30. @JoshCGrossman 30 | CREST OVS - Response to challenges 1. How can OWASP remain neutral? • OWASP defines the standards, CREST does the rest (in consultation with OWASP). • No exclusivity 2. How can we drive adoption of standard? • CREST have experience in getting assessment standards adopted in industry 3. How do we know the tester is competent? • CREST have experience in accrediting testers ASVS 5.0 - The rise of the Security Verification Standard
  • 31. @JoshCGrossman 31 | Case Study 2 – Other industry group • Oversee a large ecosystem of applications • Applications go through some form of ASVS/MASVS based assessment • Type depends on application “impact” • Needs to be scalable ASVS 5.0 - The rise of the Security Verification Standard
  • 32. @JoshCGrossman 32 | Large tech company - Other industry group 1. How can OWASP remain neutral? ▪ OWASP defines the standards, Industry group does the rest (in consultation with OWASP). ▪ No exclusivity 2. How can we drive adoption of standard? ▪ Industry members control the ecosystem 3. How do we know the tester is competent? ▪ Open problem... ASVS 5.0 - The rise of the Security Verification Standard
  • 33. @JoshCGrossman 33 | Other outstanding challenges 4. Usability of standard 5. Scope of standard 6. Scalability of standard ASVS 5.0 - The rise of the Security Verification Standard
  • 34. @JoshCGrossman 34 | Other outstanding challenges 4. Usability of standard • We are planning release 5.0 5. Scope of standard • Let us know in the issues! 6. Scalability of standard • Open problem... ASVS 5.0 - The rise of the Security Verification Standard
  • 35. @JoshCGrossman 35 | ASVS 5.0 - The rise of the Security Verification Standard
  • 36. @JoshCGrossman 36 | Key principles for 5.0 Making it easier to use by: • Clarifying existing requirements and adding new ones based on community feedback • Enhance explanations on the levels and reduce the barrier to entry • Clean up mappings • Streamline the main document ASVS 5.0 - The rise of the Security Verification Standard
  • 38. @JoshCGrossman 38 | 1) Get ready for Verification! • Expect ASVS/MASVS assessments based in the future • Application Penetration Testers: Can you start structuring your testing around the *SVS? • Application Developers: Can you structure your control documentation based on *SVS? ASVS 5.0 - The rise of the Security Verification Standard
  • 39. @JoshCGrossman 39 | Jim Manico NAME SURNAME Elar Lang Daniel Cuthbert NAME SURNAME Andrew Van der Stock NAME SURNAME Josh Grossman 2) Help with version 5.0 But we need you too!!! ASVS 5.0 - The rise of the Security Verification Standard
  • 40. @JoshCGrossman 40 | • Submit issues/change suggestions • Submit general feedback • Comment on other people's issues https://github.com/OWASP/ASVS/issues https://github.com/OWASP/ASVS/blob/master/CONTRIBUTING.md 2) Help with version 5.0 ASVS 5.0 - The rise of the Security Verification Standard
  • 41. https://xkcd.com/2347/ @JoshCGrossman 41 | 3) Support the standard https://xkcd.com/2347/ ASVS 5.0 - The rise of the Security Verification Standard
  • 42. @JoshCGrossman 42 | 3) Support the standard Thanks to our supporters! ASVS 5.0 - The rise of the Security Verification Standard
  • 43. @JoshCGrossman 43 | 3) Support the standard ASVS 5.0 - The rise of the Security Verification Standard
  • 44. @JoshCGrossman 44 | • Get ready for Verification! • Help with version 5.0 • Support the standard Summary ASVS 5.0 - The rise of the Security Verification Standard
  • 46. 46 | Whilst I have you… Tel Aviv, May 2023 Tell your friends! Tell your employers! https://appsecil.org/ @OWASP_IL
  • 47. THANK YOU! ASVS Project @OWASP_ASVS https://github.com/OWASP/ASVS https://owasp.slack.com, #project-asvs https://owasp.org/asvs Josh Grossman josh.grossman@owasp.org josh@bouncesecurity.com @JoshCGrossman Any Questions? Thanks to Michal Kamensky for help with the slides