News Application Security
New Open Standard Arrives For Gauging Security of Web Apps, Services
OWASP releases Application Security Verification Standard for developers, security pros, and buyers
Now there's an open industry standard for Web application and Web service security: The Open Web Application Security Project (OWASP) Foundation has released the Application Security Verification Standard (ASVS).
Mike Boberski, project lead and co-author of OWASP's ASVS Project, says the main goal of the standard is to provide a commercial and workable open standard for application security verification. The standard is aimed at helping Web application developers with a "yardstick" to assess the degree of security of their apps, and to help security folks determine what to build into their apps security-wise, according to Boberski. And the standard also can be used in procurements for specifying security verification requirements, he says. This is OWASP's first-ever standard.
More Security Insights
White Papers
- Remote Data Replication: Combat Disasters And Optimize Business Operations
- Check Point 2013 Internet Security Report
Reports
- Strengthening Enterprise Defenses With Threat Intelligence
- Strategy: Advanced Persistent Threats: The New Reality
Webcasts
More >>ASVS includes four levels of security verification, each with specific security requirements it must address. "It starts with Level 1, prescribing the use of automated tools augmented with manual verification," Boberski says. "It then progresses to Level 4, which includes searching for malicious code manually."
The standard, among other things, will help "differentiate between folks running tools and folks doing detailed design-based analysis" in their Web applications.
While Level 1 encompasses automated scanning, Level 2 includes manual penetration testing; Level 3 includes design verification; and Level 4, internal verification, which includes also ensuring the developers themselves are not malicious. "Level 4 includes, for example, a search for malicious code, to check for the handiwork of evil developers during development," Boberski says.
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message
Related Reading
Dark Reading Discussions
Start the Discussion
 |
To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy. |
