OWASP ASVS

The OWASP Application Security Verification Standard is a list of security requirements for verifying web applications, grouped into chapters. Pentr's YAML declares it as name OWASP Application Security Verification Standard, version 4.0.3. Its controls are ASVS chapters, such as V2 and V14, not individual requirements.

Controls¶

The chapters the YAML declares, and the tables that reach each one. The Reached by column is explained on Frameworks.

Control	Name	Reached by
V2	Authentication	ATT&CK, WSTG, keywords
V3	Session Management	WSTG
V4	Access Control	ATT&CK, WSTG, keywords
V5	Validation, Sanitization and Encoding	ATT&CK, WSTG, keywords
V7	Error Handling and Logging	WSTG, keywords
V8	Data Protection	ATT&CK, keywords
V9	Communication	WSTG, keywords
V11	Business Logic	none
V14	Configuration	ATT&CK, WSTG, keywords

V11 reads none: no table lists it, so it is reported not_tested on every run.

ATT&CK technique mappings¶

Each ATT&CK technique id in the framework's table and the chapters it maps to. A finding tagged with one of these ids maps to every chapter in its row.

Technique	Controls
T1190	V5, V14
T1078	V2, V4
T1059	V5
T1068	V4
T1110	V2
T1003	V2, V8
T1046	V14
T1018	V14
T1021	V4
T1083	V4

WSTG mappings¶

Each WSTG id in the framework's table and the chapters it maps to. A finding tagged with one of these ids maps to every chapter in its row.

WSTG id	Controls
WSTG-INPV-05	V5
WSTG-INPV-01	V5
WSTG-INPV-02	V5
WSTG-ATHN-04	V2
WSTG-ATHN-01	V9
WSTG-IDNT-04	V2
WSTG-CRYP-01	V9
WSTG-CONF-01	V14
WSTG-CONF-02	V14
WSTG-ATHZ-01	V4
WSTG-SESS-02	V3
WSTG-ERRH-01	V7

What Pentr does not attest to¶

• tested means at least one finding mapped to the chapter. It does not mean the chapter was assessed, met or failed. A mapping made by the keyword step can attach a chapter the finding does not bear on; see Frameworks.
• not_tested means no finding mapped to the chapter. It does not mean the chapter passed, and it says nothing about whether the chapter is in place.
• The mapping tables are Pentr's, written for the application. They are not published by OWASP.
• A chapter that the YAML does not declare has no row in the report.
• A tested chapter does not mean any requirement in it was verified. The YAML has no notion of ASVS verification levels, so no output states an ASVS verification level.
• A Pentr report is not an ASVS verification and not an audit opinion.

The product page for this framework is OWASP ASVS.