OWASP

Question 1

What is the purpose of OWASP Application Security Verification Standard (ASVS)?

Answer 1

to provide:
* basis for testing web application technical security controls
* a list of requirements for secure development

Question 2

How should be OWASP Application Security Verification Standard (ASVS) used?

Answer 2

• as a metric
  
  • provide application developers and application owners with a yardstick with which to assess the degree of trust that can be placed in their Web applications
• as guidance
  
  • provide guidance to security control developers as to what to build into security controls in order to satisfy application security requirements
• during procurement
  
  • provide a basis for specifying application security verification requirements in contracts

Question 3

What are the three different ASVS verification levels?

Answer 3

1. ASVS Level 1 - low assurance levels, completely penetration testable
2. ASVS Level 2 - for applications that contain sensitive data, which requires protection
3. ASVS Level 3 - for the most critical applications; applications that perform high value transactions, contain sensitive medical data, or any application that requires the highest level of trust

Question 4

What is the recommended ASVS verification level for most apps?

Answer 4

ASVS Level 2

Question 5

What is the only ASVS level that is completely penetration testable using humans?

Answer 5

Level 1; all others require access to documentation, source code, configuration, and the people involved in the development process

Question 6

Is black box testing the preferable method of testing according to ASVS?

Answer 6

no, it is not an effective assurance activity and should be actively discouraged; black box testing does not provide enough assurance due to the lack of time of penetration testers, that security holes were patched after the development

Question 7

According to ASVS, which 2 security testings are only possible to be done with human assistance?

Answer 7

1. testing against business logic flaws
2. access control testing

Question 8

What is the best way of using ASVS?

Answer 8

use it as a blueprint to create a Secure Coding Checklist specific to the application being developed, platform or organization