OWASP

EN: Publications of the OWASP Foundation, https://owasp.org/. OWASP® is a registered trademark of the OWASP Foundation, Inc.; GRCA is not affiliated with, nor endorsed by, the OWASP Foundation. Only the versions published by OWASP are authoritative.

DE: Veröffentlichungen der OWASP Foundation, https://owasp.org/. OWASP® ist eine eingetragene Marke der OWASP Foundation, Inc.; GRCA steht in keiner Verbindung zur OWASP Foundation und wird von ihr nicht unterstützt. Maßgeblich sind allein die von OWASP veröffentlichten Fassungen.

Nessun documento in questa lingua, vengono mostrati quelli in inglese.

Ticket
Standard OWASP Application Security Verification Standard 5.0.0
Standard OWASP Mobile Application Security Testing Guide (MASTG) v2.0.0
Standard OWASP Mobile Application Security Verification Standard (MASVS) v2.1.0
Standard OWASP Software Assurance Maturity Model (SAMM) v2.2.0
Standard OWASP Top 10:2025

OWASP Application Security Verification Standard 5.0.0

Ticket
+ OWASP Application Security Verification Standard 5.0.0
---+ V1 Encoding and Sanitization
------+ V1.1 Encoding and Sanitization Architecture
---------+ V1.1.1 Verify that input is decoded or unescaped into a canonical form only once, it is only decoded when …
---------+ V1.1.2 Verify that the application performs output encoding and escaping either as a final step before …
------+ V1.2 Injection Prevention
---------+ V1.2.1 Verify that output encoding for an HTTP response, HTML document, or XML document is relevant for …
---------+ V1.2.2 Verify that when dynamically building URLs, untrusted data is encoded according to its context …
---------+ V1.2.3 Verify that output encoding or escaping is used when dynamically building JavaScript content …
---------+ V1.2.4 Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized …
---------+ V1.2.5 Verify that the application protects against OS command injection and that operating system calls …
---------+ V1.2.6 Verify that the application protects against LDAP injection vulnerabilities, or that specific …
---------+ V1.2.7 Verify that the application is protected against XPath injection attacks by using query …
---------+ V1.2.8 Verify that LaTeX processors are configured securely (such as not using the "--shell-escape" flag) …
---------+ V1.2.9 Verify that the application escapes special characters in regular expressions (typically using a …
---------+ V1.2.10 Verify that the application is protected against CSV and Formula Injection. The application must …
------+ V1.3 Sanitization
---------+ V1.3.1 Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a …
---------+ V1.3.2 Verify that the application avoids the use of eval() or other dynamic code execution features such …
---------+ V1.3.3 Verify that data being passed to a potentially dangerous context is sanitized beforehand to enforce …
---------+ V1.3.4 Verify that user-supplied Scalable Vector Graphics (SVG) scriptable content is validated or …
---------+ V1.3.5 Verify that the application sanitizes or disables user-supplied scriptable or expression template …
---------+ V1.3.6 Verify that the application protects against Server-side Request Forgery (SSRF) attacks, by …
---------+ V1.3.7 Verify that the application protects against template injection attacks by not allowing templates …
---------+ V1.3.8 Verify that the application appropriately sanitizes untrusted input before use in Java Naming and …
---------+ V1.3.9 Verify that the application sanitizes content before it is sent to memcache to prevent injection …
---------+ V1.3.10 Verify that format strings which might resolve in an unexpected or malicious way when used are …
---------+ V1.3.11 Verify that the application sanitizes user input before passing to mail systems to protect against …
---------+ V1.3.12 Verify that regular expressions are free from elements causing exponential backtracking, and ensure …
------+ V1.4 Memory, String, and Unmanaged Code
---------+ V1.4.1 Verify that the application uses memory-safe string, safer memory copy and pointer arithmetic to …
---------+ V1.4.2 Verify that sign, range, and input validation techniques are used to prevent integer overflows.
---------+ V1.4.3 Verify that dynamically allocated memory and resources are released, and that references or …
------+ V1.5 Safe Deserialization
---------+ V1.5.1 Verify that the application configures XML parsers to use a restrictive configuration and that …
---------+ V1.5.2 Verify that deserialization of untrusted data enforces safe input handling, such as using an …
---------+ V1.5.3 Verify that different parsers used in the application for the same data type (e.g., JSON parsers …
---+ V2 Validation and Business Logic
------+ V2.1 Validation and Business Logic Documentation
---------+ V2.1.1 Verify that the application's documentation defines input validation rules for how to check the …
---------+ V2.1.2 Verify that the application's documentation defines how to validate the logical and contextual …
---------+ V2.1.3 Verify that expectations for business logic limits and validations are documented, including both …
------+ V2.2 Input Validation
---------+ V2.2.1 Verify that input is validated to enforce business or functional expectations for that input. This …
---------+ V2.2.2 Verify that the application is designed to enforce input validation at a trusted service layer. …
---------+ V2.2.3 Verify that the application ensures that combinations of related data items are reasonable …
------+ V2.3 Business Logic Security
---------+ V2.3.1 Verify that the application will only process business logic flows for the same user in the …
---------+ V2.3.2 Verify that business logic limits are implemented per the application's documentation to avoid …
---------+ V2.3.3 Verify that transactions are being used at the business logic level such that either a business …
---------+ V2.3.4 Verify that business logic level locking mechanisms are used to ensure that limited quantity …
---------+ V2.3.5 Verify that high-value business logic flows require multi-user approval to prevent unauthorized or …
------+ V2.4 Anti-automation
---------+ V2.4.1 Verify that anti-automation controls are in place to protect against excessive calls to application …
---------+ V2.4.2 Verify that business logic flows require realistic human timing, preventing excessively rapid …
---+ V3 Web Frontend Security
------+ V3.1 Web Frontend Security Documentation
---------+ V3.1.1 Verify that application documentation states the expected security features that browsers using the …
------+ V3.2 Unintended Content Interpretation
---------+ V3.2.1 Verify that security controls are in place to prevent browsers from rendering content or …
---------+ V3.2.2 Verify that content intended to be displayed as text, rather than rendered as HTML, is handled …
---------+ V3.2.3 Verify that the application avoids DOM clobbering when using client-side JavaScript by employing …
------+ V3.3 Cookie Setup
---------+ V3.3.1 Verify that cookies have the 'Secure' attribute set, and if the '__Host-' prefix is not used for …
---------+ V3.3.2 Verify that each cookie's 'SameSite' attribute value is set according to the purpose of the cookie …
---------+ V3.3.3 Verify that cookies have the '__Host-' prefix for the cookie name unless they are explicitly …
---------+ V3.3.4 Verify that if the value of a cookie is not meant to be accessible to client-side scripts (such as …
---------+ V3.3.5 Verify that when the application writes a cookie, the cookie name and value length combined are not …
------+ V3.4 Browser Security Mechanism Headers
---------+ V3.4.1 Verify that a Strict-Transport-Security header field is included on all responses to enforce an …
---------+ V3.4.2 Verify that the Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header field is a …
---------+ V3.4.3 Verify that HTTP responses include a Content-Security-Policy response header field which defines …
---------+ V3.4.4 Verify that all HTTP responses contain an 'X-Content-Type-Options: nosniff' header field. This …
---------+ V3.4.5 Verify that the application sets a referrer policy to prevent leakage of technically sensitive data …
---------+ V3.4.6 Verify that the web application uses the frame-ancestors directive of the Content-Security-Policy …
---------+ V3.4.7 Verify that the Content-Security-Policy header field specifies a location to report violations.
---------+ V3.4.8 Verify that all HTTP responses that initiate a document rendering (such as responses with …
------+ V3.5 Browser Origin Separation
---------+ V3.5.1 Verify that, if the application does not rely on the CORS preflight mechanism to prevent disallowed …
---------+ V3.5.2 Verify that, if the application relies on the CORS preflight mechanism to prevent disallowed …
---------+ V3.5.3 Verify that HTTP requests to sensitive functionality use appropriate HTTP methods such as POST …
---------+ V3.5.4 Verify that separate applications are hosted on different hostnames to leverage the restrictions …
---------+ V3.5.5 Verify that messages received by the postMessage interface are discarded if the origin of the …
---------+ V3.5.6 Verify that JSONP functionality is not enabled anywhere across the application to avoid Cross-Site …
---------+ V3.5.7 Verify that data requiring authorization is not included in script resource responses, like …
---------+ V3.5.8 Verify that authenticated resources (such as images, videos, scripts, and other documents) can be …
------+ V3.6 External Resource Integrity
---------+ V3.6.1 Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted …
------+ V3.7 Other Browser Security Considerations
---------+ V3.7.1 Verify that the application only uses client-side technologies which are still supported and …
---------+ V3.7.2 Verify that the application will only automatically redirect the user to a different hostname or …
---------+ V3.7.3 Verify that the application shows a notification when the user is being redirected to a URL outside …
---------+ V3.7.4 Verify that the application's top-level domain (e.g., site.tld) is added to the public preload list …
---------+ V3.7.5 Verify that the application behaves as documented (such as warning the user or blocking access) if …
---+ V4 API and Web Service
------+ V4.1 Generic Web Service Security
---------+ V4.1.1 Verify that every HTTP response with a message body contains a Content-Type header field that …
---------+ V4.1.2 Verify that only user-facing endpoints (intended for manual web-browser access) automatically …
---------+ V4.1.3 Verify that any HTTP header field used by the application and set by an intermediary layer, such as …
---------+ V4.1.4 Verify that only HTTP methods that are explicitly supported by the application or its API …
---------+ V4.1.5 Verify that per-message digital signatures are used to provide additional assurance on top of …
------+ V4.2 HTTP Message Structure Validation
---------+ V4.2.1 Verify that all application components (including load balancers, firewalls, and application …
---------+ V4.2.2 Verify that when generating HTTP messages, the Content-Length header field does not conflict with …
---------+ V4.2.3 Verify that the application does not send nor accept HTTP/2 or HTTP/3 messages with …
---------+ V4.2.4 Verify that the application only accepts HTTP/2 and HTTP/3 requests where the header fields and …
---------+ V4.2.5 Verify that, if the application (backend or frontend) builds and sends requests, it uses …
------+ V4.3 GraphQL
---------+ V4.3.1 Verify that a query allowlist, depth limiting, amount limiting, or query cost analysis is used to …
---------+ V4.3.2 Verify that GraphQL introspection queries are disabled in the production environment unless the …
------+ V4.4 WebSocket
---------+ V4.4.1 Verify that WebSocket over TLS (WSS) is used for all WebSocket connections.
---------+ V4.4.2 Verify that, during the initial HTTP WebSocket handshake, the Origin header field is checked …
---------+ V4.4.3 Verify that, if the application's standard session management cannot be used, dedicated tokens are …
---------+ V4.4.4 Verify that dedicated WebSocket session management tokens are initially obtained or validated …
---+ V5 File Handling
------+ V5.1 File Handling Documentation
---------+ V5.1.1 Verify that the documentation defines the permitted file types, expected file extensions, and …
------+ V5.2 File Upload and Content
---------+ V5.2.1 Verify that the application will only accept files of a size which it can process without causing a …
---------+ V5.2.2 Verify that when the application accepts a file, either on its own or within an archive such as a …
---------+ V5.2.3 Verify that the application checks compressed files (e.g., zip, gz, docx, odt) against maximum …
---------+ V5.2.4 Verify that a file size quota and maximum number of files per user are enforced to ensure that a …
---------+ V5.2.5 Verify that the application does not allow uploading compressed files containing symlinks unless …
---------+ V5.2.6 Verify that the application rejects uploaded images with a pixel size larger than the maximum …
------+ V5.3 File Storage
---------+ V5.3.1 Verify that files uploaded or generated by untrusted input and stored in a public folder, are not …
---------+ V5.3.2 Verify that when the application creates file paths for file operations, instead of user-submitted …
---------+ V5.3.3 Verify that server-side file processing, such as file decompression, ignores user-provided path …
------+ V5.4 File Download
---------+ V5.4.1 Verify that the application validates or ignores user-submitted filenames, including in a JSON …
---------+ V5.4.2 Verify that file names served (e.g., in HTTP response header fields or email attachments) are …
---------+ V5.4.3 Verify that files obtained from untrusted sources are scanned by antivirus scanners to prevent …
---+ V6 Authentication
------+ V6.1 Authentication Documentation
---------+ V6.1.1 Verify that application documentation defines how controls such as rate limiting, anti-automation …
---------+ V6.1.2 Verify that a list of context-specific words is documented in order to prevent their use in …
---------+ V6.1.3 Verify that, if the application includes multiple authentication pathways, these are all documented …
------+ V6.2 Password Security
---------+ V6.2.1 Verify that user set passwords are at least 8 characters in length although a minimum of 15 …
---------+ V6.2.2 Verify that users can change their password.
---------+ V6.2.3 Verify that password change functionality requires the user's current and new password.
---------+ V6.2.4 Verify that passwords submitted during account registration or password change are checked against …
---------+ V6.2.5 Verify that passwords of any composition can be used, without rules limiting the type of characters …
---------+ V6.2.6 Verify that password input fields use type=password to mask the entry. Applications may allow the …
---------+ V6.2.7 Verify that "paste" functionality, browser password helpers, and external password managers are …
---------+ V6.2.8 Verify that the application verifies the user's password exactly as received from the user, without …
---------+ V6.2.9 Verify that passwords of at least 64 characters are permitted.
---------+ V6.2.10 Verify that a user's password stays valid until it is discovered to be compromised or the user …
---------+ V6.2.11 Verify that the documented list of context specific words is used to prevent easy to guess …
---------+ V6.2.12 Verify that passwords submitted during account registration or password changes are checked against …
------+ V6.3 General Authentication Security
---------+ V6.3.1 Verify that controls to prevent attacks such as credential stuffing and password brute force are …
---------+ V6.3.2 Verify that default user accounts (e.g., "root", "admin", or "sa") are not present in the …
---------+ V6.3.3 Verify that either a multi-factor authentication mechanism or a combination of single-factor …
---------+ V6.3.4 Verify that, if the application includes multiple authentication pathways, there are no …
---------+ V6.3.5 Verify that users are notified of suspicious authentication attempts (successful or unsuccessful). …
---------+ V6.3.6 Verify that email is not used as either a single-factor or multi-factor authentication mechanism.
---------+ V6.3.7 Verify that users are notified after updates to authentication details, such as credential resets …
---------+ V6.3.8 Verify that valid users cannot be deduced from failed authentication challenges, such as by basing …
------+ V6.4 Authentication Factor Lifecycle and Recovery
---------+ V6.4.1 Verify that system generated initial passwords or activation codes are securely randomly generated …
---------+ V6.4.2 Verify that password hints or knowledge-based authentication (so-called "secret questions") are not …
---------+ V6.4.3 Verify that a secure process for resetting a forgotten password is implemented, that does not …
---------+ V6.4.4 Verify that if a multi-factor authentication factor is lost, evidence of identity proofing is …
---------+ V6.4.5 Verify that renewal instructions for authentication mechanisms which expire are sent with enough …
---------+ V6.4.6 Verify that administrative users can initiate the password reset process for the user, but that …
------+ V6.5 General Multi-factor authentication requirements
---------+ V6.5.1 Verify that lookup secrets, out-of-band authentication requests or codes, and time-based one-time …
---------+ V6.5.2 Verify that, when being stored in the application's backend, lookup secrets with less than 112 bits …
---------+ V6.5.3 Verify that lookup secrets, out-of-band authentication code, and time-based one-time password …
---------+ V6.5.4 Verify that lookup secrets and out-of-band authentication codes have a minimum of 20 bits of …
---------+ V6.5.5 Verify that out-of-band authentication requests, codes, or tokens, as well as time-based one-time …
---------+ V6.5.6 Verify that any authentication factor (including physical devices) can be revoked in case of theft …
---------+ V6.5.7 Verify that biometric authentication mechanisms are only used as secondary factors together with …
---------+ V6.5.8 Verify that time-based one-time passwords (TOTPs) are checked based on a time source from a trusted …
------+ V6.6 Out-of-Band authentication mechanisms
---------+ V6.6.1 Verify that authentication mechanisms using the Public Switched Telephone Network (PSTN) to deliver …
---------+ V6.6.2 Verify that out-of-band authentication requests, codes, or tokens are bound to the original …
---------+ V6.6.3 Verify that a code based out-of-band authentication mechanism is protected against brute force …
---------+ V6.6.4 Verify that, where push notifications are used for multi-factor authentication, rate limiting is …
------+ V6.7 Cryptographic authentication mechanism
---------+ V6.7.1 Verify that the certificates used to verify cryptographic authentication assertions are stored in a …
---------+ V6.7.2 Verify that the challenge nonce is at least 64 bits in length, and statistically unique or unique …
------+ V6.8 Authentication with an Identity Provider
---------+ V6.8.1 Verify that, if the application supports multiple identity providers (IdPs), the user's identity …
---------+ V6.8.2 Verify that the presence and integrity of digital signatures on authentication assertions (for …
---------+ V6.8.3 Verify that SAML assertions are uniquely processed and used only once within the validity period to …
---------+ V6.8.4 Verify that, if an application uses a separate Identity Provider (IdP) and expects specific …
---+ V7 Session Management
------+ V7.1 Session Management Documentation
---------+ V7.1.1 Verify that the user's session inactivity timeout and absolute maximum session lifetime are …
---------+ V7.1.2 Verify that the documentation defines how many concurrent (parallel) sessions are allowed for one …
---------+ V7.1.3 Verify that all systems that create and manage user sessions as part of a federated identity …
------+ V7.2 Fundamental Session Management Security
---------+ V7.2.1 Verify that the application performs all session token verification using a trusted, backend …
---------+ V7.2.2 Verify that the application uses either self-contained or reference tokens that are dynamically …
---------+ V7.2.3 Verify that if reference tokens are used to represent user sessions, they are unique and generated …
---------+ V7.2.4 Verify that the application generates a new session token on user authentication, including …
------+ V7.3 Session Timeout
---------+ V7.3.1 Verify that there is an inactivity timeout such that re-authentication is enforced according to …
---------+ V7.3.2 Verify that there is an absolute maximum session lifetime such that re-authentication is enforced …
------+ V7.4 Session Termination
---------+ V7.4.1 Verify that when session termination is triggered (such as logout or expiration), the application …
---------+ V7.4.2 Verify that the application terminates all active sessions when a user account is disabled or …
---------+ V7.4.3 Verify that the application gives the option to terminate all other active sessions after a …
---------+ V7.4.4 Verify that all pages that require authentication have easy and visible access to logout …
---------+ V7.4.5 Verify that application administrators are able to terminate active sessions for an individual user …
------+ V7.5 Defenses Against Session Abuse
---------+ V7.5.1 Verify that the application requires full re-authentication before allowing modifications to …
---------+ V7.5.2 Verify that users are able to view and (having authenticated again with at least one factor) …
---------+ V7.5.3 Verify that the application requires further authentication with at least one factor or secondary …
------+ V7.6 Federated Re-authentication
---------+ V7.6.1 Verify that session lifetime and termination between Relying Parties (RPs) and Identity Providers …
---------+ V7.6.2 Verify that creation of a session requires either the user's consent or an explicit action …
---+ V8 Authorization
------+ V8.1 Authorization Documentation
---------+ V8.1.1 Verify that authorization documentation defines rules for restricting function-level and …
---------+ V8.1.2 Verify that authorization documentation defines rules for field-level access restrictions (both …
---------+ V8.1.3 Verify that the application's documentation defines the environmental and contextual attributes …
---------+ V8.1.4 Verify that authentication and authorization documentation defines how environmental and contextual …
------+ V8.2 General Authorization Design
---------+ V8.2.1 Verify that the application ensures that function-level access is restricted to consumers with …
---------+ V8.2.2 Verify that the application ensures that data-specific access is restricted to consumers with …
---------+ V8.2.3 Verify that the application ensures that field-level access is restricted to consumers with …
---------+ V8.2.4 Verify that adaptive security controls based on a consumer's environmental and contextual …
------+ V8.3 Operation Level Authorization
---------+ V8.3.1 Verify that the application enforces authorization rules at a trusted service layer and doesn't …
---------+ V8.3.2 Verify that changes to values on which authorization decisions are made are applied immediately. …
---------+ V8.3.3 Verify that access to an object is based on the originating subject's (e.g. consumer's) …
------+ V8.4 Other Authorization Considerations
---------+ V8.4.1 Verify that multi-tenant applications use cross-tenant controls to ensure consumer operations will …
---------+ V8.4.2 Verify that access to administrative interfaces incorporates multiple layers of security, including …
---+ V9 Self-contained Tokens
------+ V9.1 Token source and integrity
---------+ V9.1.1 Verify that self-contained tokens are validated using their digital signature or MAC to protect …
---------+ V9.1.2 Verify that only algorithms on an allowlist can be used to create and verify self-contained tokens …
---------+ V9.1.3 Verify that key material that is used to validate self-contained tokens is from trusted …
------+ V9.2 Token content
---------+ V9.2.1 Verify that, if a validity time span is present in the token data, the token and its content are …
---------+ V9.2.2 Verify that the service receiving a token validates the token to be the correct type and is meant …
---------+ V9.2.3 Verify that the service only accepts tokens which are intended for use with that service …
---------+ V9.2.4 Verify that, if a token issuer uses the same private key for issuing tokens to different audiences …
---+ V10 OAuth and OIDC
------+ V10.1 Generic OAuth and OIDC Security
---------+ V10.1.1 Verify that tokens are only sent to components that strictly need them. For example, when using a …
---------+ V10.1.2 Verify that the client only accepts values from the authorization server (such as the authorization …
------+ V10.2 OAuth Client
---------+ V10.2.1 Verify that, if the code flow is used, the OAuth client has protection against browser-based …
---------+ V10.2.2 Verify that, if the OAuth client can interact with more than one authorization server, it has a …
---------+ V10.2.3 Verify that the OAuth client only requests the required scopes (or other authorization parameters) …
------+ V10.3 OAuth Resource Server
---------+ V10.3.1 Verify that the resource server only accepts access tokens that are intended for use with that …
---------+ V10.3.2 Verify that the resource server enforces authorization decisions based on claims from the access …
---------+ V10.3.3 Verify that if an access control decision requires identifying a unique user from an access token …
---------+ V10.3.4 Verify that, if the resource server requires specific authentication strength, methods, or …
---------+ V10.3.5 Verify that the resource server prevents the use of stolen access tokens or replay of access tokens …
------+ V10.4 OAuth Authorization Server
---------+ V10.4.1 Verify that the authorization server validates redirect URIs based on a client-specific allowlist …
---------+ V10.4.2 Verify that, if the authorization server returns the authorization code in the authorization …
---------+ V10.4.3 Verify that the authorization code is short-lived. The maximum lifetime can be up to 10 minutes for …
---------+ V10.4.4 Verify that for a given client, the authorization server only allows the usage of grants that this …
---------+ V10.4.5 Verify that the authorization server mitigates refresh token replay attacks for public clients …
---------+ V10.4.6 Verify that, if the code grant is used, the authorization server mitigates authorization code …
---------+ V10.4.7 Verify that if the authorization server supports unauthenticated dynamic client registration, it …
---------+ V10.4.8 Verify that refresh tokens have an absolute expiration, including if sliding refresh token …
---------+ V10.4.9 Verify that refresh tokens and reference access tokens can be revoked by an authorized user using …
---------+ V10.4.10 Verify that confidential client is authenticated for client-to-authorized server backchannel …
---------+ V10.4.11 Verify that the authorization server configuration only assigns the required scopes to the OAuth …
---------+ V10.4.12 Verify that for a given client, the authorization server only allows the 'response_mode' value that …
---------+ V10.4.13 Verify that grant type 'code' is always used together with pushed authorization requests (PAR).
---------+ V10.4.14 Verify that the authorization server issues only sender-constrained (Proof-of-Possession) access …
---------+ V10.4.15 Verify that, for a server-side client (which is not executed on the end-user device), the …
---------+ V10.4.16 Verify that the client is confidential and the authorization server requires the use of strong …
------+ V10.5 OIDC Client
---------+ V10.5.1 Verify that the client (as the relying party) mitigates ID Token replay attacks. For example, by …
---------+ V10.5.2 Verify that the client uniquely identifies the user from ID Token claims, usually the 'sub' claim …
---------+ V10.5.3 Verify that the client rejects attempts by a malicious authorization server to impersonate another …
---------+ V10.5.4 Verify that the client validates that the ID Token is intended to be used for that client …
---------+ V10.5.5 Verify that, when using OIDC back-channel logout, the relying party mitigates denial of service …
------+ V10.6 OpenID Provider
---------+ V10.6.1 Verify that the OpenID Provider only allows values 'code', 'ciba', 'id_token', or 'id_token code' …
---------+ V10.6.2 Verify that the OpenID Provider mitigates denial of service through forced logout. By obtaining …
------+ V10.7 Consent Management
---------+ V10.7.1 Verify that the authorization server ensures that the user consents to each authorization request. …
---------+ V10.7.2 Verify that when the authorization server prompts for user consent, it presents sufficient and …
---------+ V10.7.3 Verify that the user can review, modify, and revoke consents which the user has granted through the …
---+ V11 Cryptography
------+ V11.1 Cryptographic Inventory and Documentation
---------+ V11.1.1 Verify that there is a documented policy for management of cryptographic keys and a cryptographic …
---------+ V11.1.2 Verify that a cryptographic inventory is performed, maintained, regularly updated, and includes all …
---------+ V11.1.3 Verify that cryptographic discovery mechanisms are employed to identify all instances of …
---------+ V11.1.4 Verify that a cryptographic inventory is maintained. This must include a documented plan that …
------+ V11.2 Secure Cryptography Implementation
---------+ V11.2.1 Verify that industry-validated implementations (including libraries and hardware-accelerated …
---------+ V11.2.2 Verify that the application is designed with crypto agility such that random number, authenticated …
---------+ V11.2.3 Verify that all cryptographic primitives utilize a minimum of 128-bits of security based on the …
---------+ V11.2.4 Verify that all cryptographic operations are constant-time, with no 'short-circuit' operations in …
---------+ V11.2.5 Verify that all cryptographic modules fail securely, and errors are handled in a way that does not …
------+ V11.3 Encryption Algorithms
---------+ V11.3.1 Verify that insecure block modes (e.g., ECB) and weak padding schemes (e.g., PKCS#1 v1.5) are not …
---------+ V11.3.2 Verify that only approved ciphers and modes such as AES with GCM are used.
---------+ V11.3.3 Verify that encrypted data is protected against unauthorized modification preferably by using an …
---------+ V11.3.4 Verify that nonces, initialization vectors, and other single-use numbers are not used for more than …
---------+ V11.3.5 Verify that any combination of an encryption algorithm and a MAC algorithm is operating in …
------+ V11.4 Hashing and Hash-based Functions
---------+ V11.4.1 Verify that only approved hash functions are used for general cryptographic use cases, including …
---------+ V11.4.2 Verify that passwords are stored using an approved, computationally intensive, key derivation …
---------+ V11.4.3 Verify that hash functions used in digital signatures, as part of data authentication or data …
---------+ V11.4.4 Verify that the application uses approved key derivation functions with key stretching parameters …
------+ V11.5 Random Values
---------+ V11.5.1 Verify that all random numbers and strings which are intended to be non-guessable must be generated …
---------+ V11.5.2 Verify that the random number generation mechanism in use is designed to work securely, even under …
------+ V11.6 Public Key Cryptography
---------+ V11.6.1 Verify that only approved cryptographic algorithms and modes of operation are used for key …
---------+ V11.6.2 Verify that approved cryptographic algorithms are used for key exchange (such as Diffie-Hellman) …
------+ V11.7 In-Use Data Cryptography
---------+ V11.7.1 Verify that full memory encryption is in use that protects sensitive data while it is in use …
---------+ V11.7.2 Verify that data minimization ensures the minimal amount of data is exposed during processing, and …
---+ V12 Secure Communication
------+ V12.1 General TLS Security Guidance
---------+ V12.1.1 Verify that only the latest recommended versions of the TLS protocol are enabled, such as TLS 1.2 …
---------+ V12.1.2 Verify that only recommended cipher suites are enabled, with the strongest cipher suites set as …
---------+ V12.1.3 Verify that the application validates that mTLS client certificates are trusted before using the …
---------+ V12.1.4 Verify that proper certification revocation, such as Online Certificate Status Protocol (OCSP) …
---------+ V12.1.5 Verify that Encrypted Client Hello (ECH) is enabled in the application's TLS settings to prevent …
------+ V12.2 HTTPS Communication with External Facing Services
---------+ V12.2.1 Verify that TLS is used for all connectivity between a client and external facing, HTTP-based …
---------+ V12.2.2 Verify that external facing services use publicly trusted TLS certificates.
------+ V12.3 General Service to Service Communication Security
---------+ V12.3.1 Verify that an encrypted protocol such as TLS is used for all inbound and outbound connections to …
---------+ V12.3.2 Verify that TLS clients validate certificates received before communicating with a TLS server.
---------+ V12.3.3 Verify that TLS or another appropriate transport encryption mechanism used for all connectivity …
---------+ V12.3.4 Verify that TLS connections between internal services use trusted certificates. Where internally …
---------+ V12.3.5 Verify that services communicating internally within a system (intra-service communications) use …
---+ V13 Configuration
------+ V13.1 Configuration Documentation
---------+ V13.1.1 Verify that all communication needs for the application are documented. This must include external …
---------+ V13.1.2 Verify that for each service the application uses, the documentation defines the maximum number of …
---------+ V13.1.3 Verify that the application documentation defines resource‑management strategies for every external …
---------+ V13.1.4 Verify that the application's documentation defines the secrets that are critical for the security …
------+ V13.2 Backend Communication Configuration
---------+ V13.2.1 Verify that communications between backend application components that don't support the …
---------+ V13.2.2 Verify that communications between backend application components, including local or operating …
---------+ V13.2.3 Verify that if a credential has to be used for service authentication, the credential being used by …
---------+ V13.2.4 Verify that an allowlist is used to define the external resources or systems with which the …
---------+ V13.2.5 Verify that the web or application server is configured with an allowlist of resources or systems …
---------+ V13.2.6 Verify that where the application connects to separate services, it follows the documented …
------+ V13.3 Secret Management
---------+ V13.3.1 Verify that a secrets management solution, such as a key vault, is used to securely create, store …
---------+ V13.3.2 Verify that access to secret assets adheres to the principle of least privilege.
---------+ V13.3.3 Verify that all cryptographic operations are performed using an isolated security module (such as a …
---------+ V13.3.4 Verify that secrets are configured to expire and be rotated based on the application's …
------+ V13.4 Unintended Information Leakage
---------+ V13.4.1 Verify that the application is deployed either without any source control metadata, including the …
---------+ V13.4.2 Verify that debug modes are disabled for all components in production environments to prevent …
---------+ V13.4.3 Verify that web servers do not expose directory listings to clients unless explicitly intended.
---------+ V13.4.4 Verify that using the HTTP TRACE method is not supported in production environments, to avoid …
---------+ V13.4.5 Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed …
---------+ V13.4.6 Verify that the application does not expose detailed version information of backend components.
---------+ V13.4.7 Verify that the web tier is configured to only serve files with specific file extensions to prevent …
---+ V14 Data Protection
------+ V14.1 Data Protection Documentation
---------+ V14.1.1 Verify that all sensitive data created and processed by the application has been identified and …
---------+ V14.1.2 Verify that all sensitive data protection levels have a documented set of protection requirements. …
------+ V14.2 General Data Protection
---------+ V14.2.1 Verify that sensitive data is only sent to the server in the HTTP message body or header fields …
---------+ V14.2.2 Verify that the application prevents sensitive data from being cached in server components, such as …
---------+ V14.2.3 Verify that defined sensitive data is not sent to untrusted parties (e.g., user trackers) to …
---------+ V14.2.4 Verify that controls around sensitive data related to encryption, integrity verification …
---------+ V14.2.5 Verify that caching mechanisms are configured to only cache responses which have the expected …
---------+ V14.2.6 Verify that the application only returns the minimum required sensitive data for the application's …
---------+ V14.2.7 Verify that sensitive information is subject to data retention classification, ensuring that …
---------+ V14.2.8 Verify that sensitive information is removed from the metadata of user-submitted files unless …
------+ V14.3 Client-side Data Protection
---------+ V14.3.1 Verify that authenticated data is cleared from client storage, such as the browser DOM, after the …
---------+ V14.3.2 Verify that the application sets sufficient anti-caching HTTP response header fields (i.e. …
---------+ V14.3.3 Verify that data stored in browser storage (such as localStorage, sessionStorage, IndexedDB, or …
---+ V15 Secure Coding and Architecture
------+ V15.1 Secure Coding and Architecture Documentation
---------+ V15.1.1 Verify that application documentation defines risk based remediation time frames for 3rd party …
---------+ V15.1.2 Verify that an inventory catalog, such as software bill of materials (SBOM), is maintained of all …
---------+ V15.1.3 Verify that the application documentation identifies functionality which is time-consuming or …
---------+ V15.1.4 Verify that application documentation highlights third-party libraries which are considered to be …
---------+ V15.1.5 Verify that application documentation highlights parts of the application where "dangerous …
------+ V15.2 Security Architecture and Dependencies
---------+ V15.2.1 Verify that the application only contains components which have not breached the documented update …
---------+ V15.2.2 Verify that the application has implemented defenses against loss of availability due to …
---------+ V15.2.3 Verify that the production environment only includes functionality that is required for the …
---------+ V15.2.4 Verify that third-party components and all of their transitive dependencies are included from the …
---------+ V15.2.5 Verify that the application implements additional protections around parts of the application which …
------+ V15.3 Defensive Coding
---------+ V15.3.1 Verify that the application only returns the required subset of fields from a data object. For …
---------+ V15.3.2 Verify that where the application backend makes calls to external URLs, it is configured to not …
---------+ V15.3.3 Verify that the application has countermeasures to protect against mass assignment attacks by …
---------+ V15.3.4 Verify that all proxying and middleware components transfer the user's original IP address …
---------+ V15.3.5 Verify that the application explicitly ensures that variables are of the correct type and performs …
---------+ V15.3.6 Verify that JavaScript code is written in a way that prevents prototype pollution, for example, by …
---------+ V15.3.7 Verify that the application has defenses against HTTP parameter pollution attacks, particularly if …
------+ V15.4 Safe Concurrency
---------+ V15.4.1 Verify that shared objects in multi-threaded code (such as caches, files, or in-memory objects …
---------+ V15.4.2 Verify that checks on a resource's state, such as its existence or permissions, and the actions …
---------+ V15.4.3 Verify that locks are used consistently to avoid threads getting stuck, whether by waiting on each …
---------+ V15.4.4 Verify that resource allocation policies prevent thread starvation by ensuring fair access to …
---+ V16 Security Logging and Error Handling
------+ V16.1 Security Logging Documentation
---------+ V16.1.1 Verify that an inventory exists documenting the logging performed at each layer of the …
------+ V16.2 General Logging
---------+ V16.2.1 Verify that each log entry includes necessary metadata (such as when, where, who, what) that would …
---------+ V16.2.2 Verify that time sources for all logging components are synchronized, and that timestamps in …
---------+ V16.2.3 Verify that the application only stores or broadcasts logs to the files and services that are …
---------+ V16.2.4 Verify that logs can be read and correlated by the log processor that is in use, preferably by …
---------+ V16.2.5 Verify that when logging sensitive data, the application enforces logging based on the data's …
------+ V16.3 Security Events
---------+ V16.3.1 Verify that all authentication operations are logged, including successful and unsuccessful …
---------+ V16.3.2 Verify that failed authorization attempts are logged. For L3, this must include logging all …
---------+ V16.3.3 Verify that the application logs the security events that are defined in the documentation and also …
---------+ V16.3.4 Verify that the application logs unexpected errors and security control failures such as backend …
------+ V16.4 Log Protection
---------+ V16.4.1 Verify that all logging components appropriately encode data to prevent log injection.
---------+ V16.4.2 Verify that logs are protected from unauthorized access and cannot be modified.
---------+ V16.4.3 Verify that logs are securely transmitted to a logically separate system for analysis, detection …
------+ V16.5 Error Handling
---------+ V16.5.1 Verify that a generic message is returned to the consumer when an unexpected or security-sensitive …
---------+ V16.5.2 Verify that the application continues to operate securely when external resource access fails, for …
---------+ V16.5.3 Verify that the application fails gracefully and securely, including when an exception occurs …
---------+ V16.5.4 Verify that a "last resort" error handler is defined which will catch all unhandled exceptions. …
---+ V17 WebRTC
------+ V17.1 TURN Server
---------+ V17.1.1 Verify that the Traversal Using Relays around NAT (TURN) service only allows access to IP addresses …
---------+ V17.1.2 Verify that the Traversal Using Relays around NAT (TURN) service is not susceptible to resource …
------+ V17.2 Media
---------+ V17.2.1 Verify that the key for the Datagram Transport Layer Security (DTLS) certificate is managed and …
---------+ V17.2.2 Verify that the media server is configured to use and support approved Datagram Transport Layer …
---------+ V17.2.3 Verify that Secure Real-time Transport Protocol (SRTP) authentication is checked at the media …
---------+ V17.2.4 Verify that the media server is able to continue processing incoming media traffic when …
---------+ V17.2.5 Verify that the media server is able to continue processing incoming media traffic during a flood …
---------+ V17.2.6 Verify that the media server is not susceptible to the "ClientHello" Race Condition vulnerability …
---------+ V17.2.7 Verify that any audio or video recording mechanisms associated with the media server are able to …
---------+ V17.2.8 Verify that the Datagram Transport Layer Security (DTLS) certificate is checked against the Session …
------+ V17.3 Signaling
---------+ V17.3.1 Verify that the signaling server is able to continue processing legitimate incoming signaling …
---------+ V17.3.2 Verify that the signaling server is able to continue processing legitimate signaling messages when …

OWASP Mobile Application Security Testing Guide (MASTG) v2.0.0

Ticket
+ OWASP Mobile Application Security Testing Guide (MASTG) v2.0.0
---+ Tests
------+ MASVS-STORAGE Storage
---------+ MASTG-TEST-0200 Files Written to External Storage (Android)
---------+ MASTG-TEST-0201 Runtime Use of APIs to Access External Storage (Android)
---------+ MASTG-TEST-0202 References to APIs and Permissions for Accessing External Storage (Android)
---------+ MASTG-TEST-0203 Runtime Use of Logging APIs (Android)
---------+ MASTG-TEST-0207 Runtime Storage of Unencrypted Data in the App Sandbox (Android)
---------+ MASTG-TEST-0215 Sensitive Data Not Marked For Backup Exclusion (iOS)
---------+ MASTG-TEST-0216 Sensitive Data Not Excluded From Backup (Android)
---------+ MASTG-TEST-0231 References to Logging APIs (Android)
---------+ MASTG-TEST-0262 References to Backup Configurations Not Excluding Sensitive Data (Android)
---------+ MASTG-TEST-0287 Runtime Storage of Unencrypted Data via the SharedPreferences API (Android)
---------+ MASTG-TEST-0296 Sensitive Data Exposure in Logs (iOS)
---------+ MASTG-TEST-0297 Sensitive Data Exposure Through Logging APIs (iOS)
---------+ MASTG-TEST-0298 Runtime Monitoring of Files Eligible for Backup (iOS)
---------+ MASTG-TEST-0299 Data Protection Classes for Files in Private Storage (iOS)
---------+ MASTG-TEST-0300 References to APIs for Storing Unencrypted Data in Private Storage (iOS)
---------+ MASTG-TEST-0301 Runtime Use of APIs for Storing Unencrypted Data in Private Storage (iOS)
---------+ MASTG-TEST-0302 Sensitive Data Unencrypted in Private Storage Files (iOS)
---------+ MASTG-TEST-0303 References to APIs for Storing Unencrypted Data in Shared Storage (iOS)
---------+ MASTG-TEST-0313 References to APIs for Preventing Keyboard Caching of Text Fields (iOS)
---------+ MASTG-TEST-0314 Runtime Monitoring of Text Fields Eligible for Keyboard Caching (iOS)
---------+ MASTG-TEST-0388 References to Sensitive Data Stored Unprotected in Shared App Group Containers (iOS)
------+ MASVS-CRYPTO Cryptography
---------+ MASTG-TEST-0204 Insecure Random API Usage (Android)
---------+ MASTG-TEST-0205 Non-random Sources Usage (Android)
---------+ MASTG-TEST-0208 Insufficient Key Sizes (Android)
---------+ MASTG-TEST-0209 Insufficient Key Sizes (iOS)
---------+ MASTG-TEST-0210 Broken Symmetric Encryption Algorithms (iOS)
---------+ MASTG-TEST-0211 Broken Hashing Algorithms (iOS)
---------+ MASTG-TEST-0212 Use of Hardcoded Cryptographic Keys in Code (Android)
---------+ MASTG-TEST-0213 Use of Hardcoded Cryptographic Keys in Code (iOS)
---------+ MASTG-TEST-0214 Hardcoded Cryptographic Keys in Files (iOS)
---------+ MASTG-TEST-0221 Broken Symmetric Encryption Algorithms (Android)
---------+ MASTG-TEST-0232 Broken Symmetric Encryption Modes (Android)
---------+ MASTG-TEST-0307 References to Asymmetric Key Pairs Used For Multiple Purposes (Android)
---------+ MASTG-TEST-0308 Runtime Use of Asymmetric Key Pairs Used For Multiple Purposes (Android)
---------+ MASTG-TEST-0311 Insecure Random API Usage (iOS)
---------+ MASTG-TEST-0312 References to Explicit Security Provider in Cryptographic APIs (Android)
---------+ MASTG-TEST-0317 Broken Symmetric Encryption Modes (iOS)
---------+ MASTG-TEST-0349 Runtime Use of Insecure Random APIs (iOS)
---------+ MASTG-TEST-0350 Runtime Use of Broken Symmetric Encryption Modes (Android)
------+ MASVS-AUTH Authentication and Authorization
---------+ MASTG-TEST-0266 References to APIs for Event-Bound Biometric Authentication (iOS)
---------+ MASTG-TEST-0267 Runtime Use Of Event-Bound Biometric Authentication (iOS)
---------+ MASTG-TEST-0268 References to APIs Allowing Fallback to Non-Biometric Authentication (iOS)
---------+ MASTG-TEST-0269 Runtime Use Of APIs Allowing Fallback to Non-Biometric Authentication (iOS)
---------+ MASTG-TEST-0270 References to APIs Detecting Biometric Enrollment Changes (iOS)
---------+ MASTG-TEST-0271 Runtime Use Of APIs Detecting Biometric Enrollment Changes (iOS)
---------+ MASTG-TEST-0326 References to APIs Allowing Fallback to Non-Biometric Authentication (Android)
---------+ MASTG-TEST-0327 References to APIs for Event-Bound Biometric Authentication (Android)
---------+ MASTG-TEST-0328 References to APIs Detecting Biometric Enrollment Changes (Android)
---------+ MASTG-TEST-0329 References to APIs Enforcing Authentication without Explicit User Action (Android)
---------+ MASTG-TEST-0330 References to APIs for Keys used in Biometric Authentication with Extended Validity Duration (Android)
------+ MASVS-NETWORK Network Communication
---------+ MASTG-TEST-0217 Insecure TLS Protocols Explicitly Allowed in Code (Android)
---------+ MASTG-TEST-0218 Insecure TLS Protocols in Network Traffic (Android)
---------+ MASTG-TEST-0233 Hardcoded HTTP URLs (Android)
---------+ MASTG-TEST-0234 Missing Implementation of Server Hostname Verification with SSLSockets (Android)
---------+ MASTG-TEST-0235 Android App Configurations Allowing Cleartext Traffic (Android)
---------+ MASTG-TEST-0236 Cleartext Traffic Observed on the Network (Network)
---------+ MASTG-TEST-0242 Missing Certificate Pinning in Network Security Configuration (Android)
---------+ MASTG-TEST-0243 Expired Certificate Pins in the Network Security Configuration (Android)
---------+ MASTG-TEST-0244 Missing Certificate Pinning in Network Traffic (Network)
---------+ MASTG-TEST-0282 Unsafe Custom Trust Evaluation (Android)
---------+ MASTG-TEST-0283 Incorrect Implementation of Server Hostname Verification (Android)
---------+ MASTG-TEST-0284 Incorrect SSL Error Handling in WebViews (Android)
---------+ MASTG-TEST-0286 Network Security Configuration Allowing Trust in User-Provided CAs (Android)
---------+ MASTG-TEST-0295 GMS Security Provider Not Updated (Android)
---------+ MASTG-TEST-0321 Hardcoded HTTP URLs (iOS)
---------+ MASTG-TEST-0322 App Transport Security Configurations Allowing Cleartext Traffic (iOS)
---------+ MASTG-TEST-0323 Uses of Low-Level Networking APIs for Cleartext Traffic (iOS)
---------+ MASTG-TEST-0342 References to Weak ATS TLS Policy Exceptions in Info.plist (iOS)
---------+ MASTG-TEST-0343 URLSession TLS Protocol Configuration (iOS)
---------+ MASTG-TEST-0344 Network.framework TLS Protocol Configuration (iOS)
---------+ MASTG-TEST-0345 Embedded or Third-party TLS Stack Configuration (iOS)
---------+ MASTG-TEST-0348 Insecure TLS Protocols in Network Traffic (iOS)
---------+ MASTG-TEST-0385 Missing Certificate Pinning in ATS (iOS)
---------+ MASTG-TEST-0396 References to URLSessionDelegate Bypassing Certificate Validation (iOS)
---------+ MASTG-TEST-0397 References to WKNavigationDelegate Bypassing Certificate Validation (iOS)
------+ MASVS-PLATFORM Platform Interaction
---------+ MASTG-TEST-0250 References to Content Provider Access in WebViews (Android)
---------+ MASTG-TEST-0251 Runtime Use of Content Provider Access APIs in WebViews (Android)
---------+ MASTG-TEST-0252 References to Local File Access in WebViews (Android)
---------+ MASTG-TEST-0253 Runtime Use of Local File Access APIs in WebViews (Android)
---------+ MASTG-TEST-0258 References to Keyboard Caching Attributes in UI Elements (Android)
---------+ MASTG-TEST-0276 Use of the iOS General Pasteboard (iOS)
---------+ MASTG-TEST-0277 Sensitive Data in the iOS General Pasteboard at Runtime (iOS)
---------+ MASTG-TEST-0278 Pasteboard Contents Not Cleared After Use (iOS)
---------+ MASTG-TEST-0279 Pasteboard Contents Not Expiring (iOS)
---------+ MASTG-TEST-0280 Pasteboard Contents Not Restricted to Local Device (iOS)
---------+ MASTG-TEST-0289 Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding (Android)
---------+ MASTG-TEST-0290 Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding (iOS)
---------+ MASTG-TEST-0291 References to Screen Capturing Prevention APIs (Android)
---------+ MASTG-TEST-0315 Sensitive Data Exposed via Notifications (Android)
---------+ MASTG-TEST-0316 App Exposing User Authentication Data in Text Input Fields (Android)
---------+ MASTG-TEST-0320 WebViews Not Cleaning Up Sensitive Data (Android)
---------+ MASTG-TEST-0332 Attacker-Controlled URI in WebViews (iOS)
---------+ MASTG-TEST-0333 Overly Broad File Read Access in WebViews (iOS)
---------+ MASTG-TEST-0334 Native Code Exposed Through WebViews (Android)
---------+ MASTG-TEST-0335 WebView File Origin Access Relaxed by Configuration (iOS)
---------+ MASTG-TEST-0336 Runtime Setting of Relaxed WebView File Origin Policies (iOS)
---------+ MASTG-TEST-0340 References to Overlay Attack Protections (Android)
---------+ MASTG-TEST-0346 References to APIs Hiding Sensitive Data in Text Input Fields (iOS)
---------+ MASTG-TEST-0347 Runtime Use of APIs Hiding Sensitive Data in Text Input Fields (iOS)
---------+ MASTG-TEST-0355 References to Unauthorized Database Access through Content Providers (Android)
---------+ MASTG-TEST-0356 Runtime Verification of Unauthorized Database Access through Content Providers (Android)
---------+ MASTG-TEST-0357 References to Oversharing of File-Based Content Providers (Android)
---------+ MASTG-TEST-0364 Exported And Unprotected Activities That Expose Sensitive Functionality (Android)
---------+ MASTG-TEST-0365 Exported And Unprotected Services That Expose Sensitive Functionality (Android)
---------+ MASTG-TEST-0366 Exported And Unprotected Broadcast Receivers That Expose Sensitive Functionality (Android)
---------+ MASTG-TEST-0370 Missing Input Validation in Custom URL Scheme Handlers (iOS)
---------+ MASTG-TEST-0371 Missing Source Validation in Custom URL Scheme Handlers (iOS)
---------+ MASTG-TEST-0376 References to Native Bridge APIs in WebViews (iOS)
---------+ MASTG-TEST-0377 References to `evaluateJavaScript` Used as Bridge Reply in `WKScriptMessageHandler` (iOS)
---------+ MASTG-TEST-0378 References to Password Fields in WebView-Loaded HTML (iOS)
---------+ MASTG-TEST-0379 References to `evaluateJavaScript` Without Content World Isolation (iOS)
---------+ MASTG-TEST-0380 References to `evaluateJavaScript` Writing Sensitive Data into WebView DOM (iOS)
---------+ MASTG-TEST-0381 References to Insecure PendingIntent Creation (Android)
---------+ MASTG-TEST-0389 References to the App-Wide Restriction of Custom Keyboards (iOS)
---------+ MASTG-TEST-0390 Full Access Requested by a Custom Keyboard Extension (iOS)
---------+ MASTG-TEST-0393 Use of Unverified App Links (Android)
---------+ MASTG-TEST-0394 Missing Input Validation in Custom URL Scheme Handlers (Android)
---------+ MASTG-TEST-0395 Missing Input Validation in Universal Link Handlers (iOS)
------+ MASVS-CODE Code Quality
---------+ MASTG-TEST-0223 Stack Canaries Not Enabled (Android)
---------+ MASTG-TEST-0228 Position Independent Code (PIC) not Enabled (iOS)
---------+ MASTG-TEST-0229 Stack Canaries Not enabled (iOS)
---------+ MASTG-TEST-0230 Automatic Reference Counting (ARC) not enabled (iOS)
---------+ MASTG-TEST-0245 References to Platform Version APIs (Android)
---------+ MASTG-TEST-0272 Identify Dependencies with Known Vulnerabilities in the Android Project (Android)
---------+ MASTG-TEST-0273 Identify Dependencies with Known Vulnerabilities by Scanning Dependency Managers Artifacts (iOS)
---------+ MASTG-TEST-0274 Dependencies with Known Vulnerabilities in the App's SBOM (Android)
---------+ MASTG-TEST-0275 Dependencies with Known Vulnerabilities in the App's SBOM (iOS)
---------+ MASTG-TEST-0337 References to Object Deserialization of Untrusted Data (Android)
---------+ MASTG-TEST-0339 SQL Injection in Content Providers (Android)
---------+ MASTG-TEST-0372 Implicit Intents Used for Internal App Communication (Android)
---------+ MASTG-TEST-0374 References to Implicit Intents Carrying Sensitive Extras (Android)
---------+ MASTG-TEST-0375 Missing Validation of Data Returned from Implicit Intents (Android)
---------+ MASTG-TEST-0382 Runtime Use of Enforced Updating APIs (Android)
---------+ MASTG-TEST-0383 References to Enforced Updating APIs (iOS)
---------+ MASTG-TEST-0384 Runtime Use of Enforced Updating APIs (iOS)
---------+ MASTG-TEST-0386 References to Object Deserialization of Untrusted Data (iOS)
---------+ MASTG-TEST-0392 References to Enforced Updating APIs (Android)
---------+ MASTG-TEST-0398 References to WebViewClient URL Loading Handlers (Android)
---------+ MASTG-TEST-0399 SafeBrowsing Disabled (Android)
---------+ MASTG-TEST-0400 Runtime Use of WebViewClient URL Loading Handlers (Android)
------+ MASVS-RESILIENCE Resilience Against Reverse Engineering and Tampering
---------+ MASTG-TEST-0219 Testing for Debugging Symbols (iOS)
---------+ MASTG-TEST-0220 Usage of Outdated Code Signature Format (iOS)
---------+ MASTG-TEST-0224 Usage of Insecure APK Signature Version (Android)
---------+ MASTG-TEST-0225 Usage of Insecure APK Signature Key Size (Android)
---------+ MASTG-TEST-0226 Debuggable Flag Enabled in the AndroidManifest (Android)
---------+ MASTG-TEST-0227 Debugging Enabled for WebViews (Android)
---------+ MASTG-TEST-0240 Jailbreak Detection in Code (iOS)
---------+ MASTG-TEST-0241 Runtime Use of Jailbreak Detection Techniques (iOS)
---------+ MASTG-TEST-0246 Runtime Use of Secure Screen Lock Detection APIs (iOS)
---------+ MASTG-TEST-0247 References to APIs for Detecting Secure Screen Lock (Android)
---------+ MASTG-TEST-0248 References to APIs for Detecting Secure Screen Lock (iOS)
---------+ MASTG-TEST-0249 Runtime Use of Secure Screen Lock Detection APIs (Android)
---------+ MASTG-TEST-0261 Debuggable Entitlement Enabled in the entitlements.plist (iOS)
---------+ MASTG-TEST-0263 Logging of StrictMode Violations (Android)
---------+ MASTG-TEST-0264 Runtime Use of StrictMode APIs (Android)
---------+ MASTG-TEST-0265 References to StrictMode APIs (Android)
---------+ MASTG-TEST-0288 Debugging Symbols in Native Binaries (Android)
---------+ MASTG-TEST-0324 References to Root Detection Mechanisms (Android)
---------+ MASTG-TEST-0325 Runtime Use of Root Detection Techniques (Android)
---------+ MASTG-TEST-0338 References to Storage Integrity Check APIs (Android)
---------+ MASTG-TEST-0341 Runtime Use of Hook Detection Techniques (Android)
---------+ MASTG-TEST-0351 Runtime Use of Emulator Detection Techniques (Android)
---------+ MASTG-TEST-0352 References to Debugging Detection APIs (Android)
---------+ MASTG-TEST-0353 Runtime Use of Debugging Detection APIs (Android)
---------+ MASTG-TEST-0354 Runtime Use of Hook Detection Techniques (iOS)
---------+ MASTG-TEST-0358 Implementation Details Exposure Through Logging APIs (iOS)
---------+ MASTG-TEST-0359 Implementation Details Exposure in Logs (iOS)
---------+ MASTG-TEST-0367 Runtime Use of Virtual Device Detection Techniques (iOS)
---------+ MASTG-TEST-0368 Insufficient Obfuscation of Security-Relevant Java/Kotlin Code (Android)
---------+ MASTG-TEST-0369 Insufficient Obfuscation of Security-Relevant Native Code (Android)
---------+ MASTG-TEST-0387 References to Storage Integrity Check APIs (iOS)
---------+ MASTG-TEST-0391 Insufficient Obfuscation of Security-Relevant Native Code (iOS)
---------+ MASTG-TEST-0401 References to Debugging Detection APIs (iOS)
---------+ MASTG-TEST-0402 Runtime Use of Debugging Detection APIs (iOS)
------+ MASVS-PRIVACY Privacy
---------+ MASTG-TEST-0206 Undeclared PII in Network Traffic Capture (Android)
---------+ MASTG-TEST-0254 Dangerous App Permissions (Android)
---------+ MASTG-TEST-0281 Undeclared Known Tracking Domains (iOS)
---------+ MASTG-TEST-0318 References to SDK APIs Known to Handle Sensitive User Data (Android)
---------+ MASTG-TEST-0319 Runtime Use of SDK APIs Known to Handle Sensitive User Data (Android)
---------+ MASTG-TEST-0360 Purpose String Accuracy for Reachable Protected Resource Access (iOS)
---------+ MASTG-TEST-0361 Runtime Use of Protected Resource APIs Without Accurate Purpose Strings (iOS)
---------+ MASTG-TEST-0362 Entitlements for Unjustified Capability Exposure (iOS)
---------+ MASTG-TEST-0363 Runtime Use of Entitlement-Backed APIs for Unjustified Capability Exposure (iOS)
---+ Best Practices
------+ MASTG-BEST-0001 Use Secure Random Number Generator APIs (Android)
------+ MASTG-BEST-0002 Remove Logging Code (Android)
------+ MASTG-BEST-0003 Comply with Privacy Regulations and Best Practices (Android)
------+ MASTG-BEST-0004 Exclude Sensitive Data from Backups (Android)
------+ MASTG-BEST-0005 Use Secure Encryption Modes (Android)
------+ MASTG-BEST-0006 Use Up-to-Date APK Signing Schemes (Android)
------+ MASTG-BEST-0007 Debuggable Flag Disabled in the AndroidManifest (Android)
------+ MASTG-BEST-0008 Debugging Disabled for WebViews (Android)
------+ MASTG-BEST-0009 Use Secure Encryption Algorithms (Android)
------+ MASTG-BEST-0010 Use Up-to-Date minSdkVersion (Android)
------+ MASTG-BEST-0011 Securely Load File Content in a WebView (Android)
------+ MASTG-BEST-0012 Disable JavaScript in WebViews (Android)
------+ MASTG-BEST-0013 Disable Content Provider Access in WebViews (Android)
------+ MASTG-BEST-0014 Preventing Screenshots and Screen Recording (Android)
------+ MASTG-BEST-0020 Update the GMS Security Provider (Android)
------+ MASTG-BEST-0021 Ensure Proper Error and Exception Handling (Android)
------+ MASTG-BEST-0022 Disable Verbose and Debug Logging in Production Builds (iOS)
------+ MASTG-BEST-0023 Exclude Sensitive Information from Backups (iOS)
------+ MASTG-BEST-0024 Store Data Encrypted in App Sandbox Directory (iOS)
------+ MASTG-BEST-0025 Use Secure Random Number Generator APIs (iOS)
------+ MASTG-BEST-0028 WebViews Cache Cleanup (Android)
------+ MASTG-BEST-0030 Implementing Root Detection (Generic)
------+ MASTG-BEST-0031 Enforce Strong Biometrics for Sensitive Operations (Android)
------+ MASTG-BEST-0032 Migrate from UIWebView to WKWebView (iOS)
------+ MASTG-BEST-0033 Securely Load File Content in a WebView (iOS)
------+ MASTG-BEST-0034 Validate WebView Input (iOS)
------+ MASTG-BEST-0035 Prefer Origin Scoped Messaging Over Legacy JavaScript Bridges (Android)
------+ MASTG-BEST-0036 Use Cryptographic Binding for Biometric Authentication (Android)
------+ MASTG-BEST-0037 Invalidate Biometric Keys on Enrollment Changes (Android)
------+ MASTG-BEST-0038 Require Explicit User Confirmation for Biometric Authentication (Android)
------+ MASTG-BEST-0039 Prevent SQL Injection in ContentProviders (Android)
------+ MASTG-BEST-0040 Preventing Overlay Attacks (Android)
------+ MASTG-BEST-0041 Hardening Against Runtime Hooking (Android)
------+ MASTG-BEST-0042 Use Strong TLS Settings in ATS Configuration (iOS)
------+ MASTG-BEST-0043 Enforce Strong TLS Settings When ATS Doesn't Apply (iOS)
------+ MASTG-BEST-0044 Mask Sensitive Data in Text Input Fields (iOS)
------+ MASTG-BEST-0045 Limit Sensitive Data Exposure Through iOS IPC Channels (iOS)
------+ MASTG-BEST-0046 Hardening Against Emulation (Android)
------+ MASTG-BEST-0047 Continuous Anti-Debugging Checks (Android)
------+ MASTG-BEST-0048 Hardening Against Reverse Engineering Tools (iOS)
------+ MASTG-BEST-0049 Restrict and Validate Access to Exported Content Providers (Android)
------+ MASTG-BEST-0050 Store Data Encrypted in App Sandbox Directory (Android)
------+ MASTG-BEST-0051 Minimize iOS Permissions and Entitlements (iOS)
------+ MASTG-BEST-0052 Restrict Access to Android App Components (Android)
------+ MASTG-BEST-0053 Hardening Against Virtual Devices (iOS)
------+ MASTG-BEST-0054 Validate Input Parameters in Custom URL Scheme Handlers (iOS)
------+ MASTG-BEST-0055 Validate Source Application in Custom URL Scheme Handlers (iOS)
------+ MASTG-BEST-0056 Use Explicit Intents for Internal IPC (Android)
------+ MASTG-BEST-0057 Sanitize Data Coming from External Components (Android)
------+ MASTG-BEST-0058 Restrict Native Functionality Exposed Through WebView Bridges (iOS)
------+ MASTG-BEST-0059 Render Sensitive UI as Native Views Over the WebView (iOS)
------+ MASTG-BEST-0060 Use Native Views for Sensitive Text Entry Over a WebView (iOS)
------+ MASTG-BEST-0061 Use WKContentWorld Isolation for DOM Inspection Scripts (iOS)
------+ MASTG-BEST-0062 Use WKScriptMessageHandlerWithReply to Return Data to JavaScript (iOS)
------+ MASTG-BEST-0063 Use Immutable PendingIntents with Explicit Intents (Android)
------+ MASTG-BEST-0064 Use Safe APIs for Object Deserialization (iOS)
------+ MASTG-BEST-0065 Implementing Storage Integrity Checks on iOS (iOS)
------+ MASTG-BEST-0066 Implementing Storage Integrity Checks on Android (Android)
------+ MASTG-BEST-0067 Implementing Source Code Integrity Checks on iOS (iOS)
------+ MASTG-BEST-0068 Secure Data Sharing Between App Extensions and Containing Apps (iOS)
------+ MASTG-BEST-0069 Keep Sensitive Input on the System Keyboard (iOS)
------+ MASTG-BEST-0070 Verify Android App Links with autoVerify and Digital Asset Links (Android)
------+ MASTG-BEST-0071 Validate Input Parameters in Deep Link and Custom URL Scheme Handlers (Android)
------+ MASTG-BEST-0072 Validate Input Parameters in Universal Link Handlers (iOS)
------+ MASTG-BEST-0073 Properly Validate Server Trust in URLSessionDelegate and WKNavigationDelegate (iOS)
------+ MASTG-BEST-0074 Implementing Anti-Debugging Checks on iOS (iOS)

OWASP Mobile Application Security Verification Standard (MASVS) v2.1.0

Ticket
+ OWASP Mobile Application Security Verification Standard (MASVS) v2.1.0
---+ MASVS-STORAGE Storage
------+ MASVS-STORAGE-1 The app securely stores sensitive data.
------+ MASVS-STORAGE-2 The app prevents leakage of sensitive data.
---+ MASVS-CRYPTO Cryptography
------+ MASVS-CRYPTO-1 The app employs current strong cryptography and uses it according to industry best practices.
------+ MASVS-CRYPTO-2 The app performs key management according to industry best practices.
---+ MASVS-AUTH Authentication and Authorization
------+ MASVS-AUTH-1 The app uses secure authentication and authorization protocols and follows the relevant best practices.
------+ MASVS-AUTH-2 The app performs local authentication securely according to the platform best practices.
------+ MASVS-AUTH-3 The app secures sensitive operations with additional authentication.
---+ MASVS-NETWORK Network Communication
------+ MASVS-NETWORK-1 The app secures all network traffic according to the current best practices.
------+ MASVS-NETWORK-2 The app performs identity pinning for all remote endpoints under the developer's control.
---+ MASVS-PLATFORM Platform Interaction
------+ MASVS-PLATFORM-1 The app uses IPC mechanisms securely.
------+ MASVS-PLATFORM-2 The app uses WebViews securely.
------+ MASVS-PLATFORM-3 The app uses the user interface securely.
---+ MASVS-CODE Code Quality
------+ MASVS-CODE-1 The app requires an up-to-date platform version.
------+ MASVS-CODE-2 The app has a mechanism for enforcing app updates.
------+ MASVS-CODE-3 The app only uses software components without known vulnerabilities.
------+ MASVS-CODE-4 The app validates and sanitizes all untrusted inputs.
---+ MASVS-RESILIENCE Resilience Against Reverse Engineering and Tampering
------+ MASVS-RESILIENCE-1 The app validates the integrity of the platform.
------+ MASVS-RESILIENCE-2 The app implements anti-tampering mechanisms.
------+ MASVS-RESILIENCE-3 The app implements anti-static analysis mechanisms.
------+ MASVS-RESILIENCE-4 The app implements anti-dynamic analysis techniques.
---+ MASVS-PRIVACY Privacy
------+ MASVS-PRIVACY-1 The app minimizes access to sensitive data and resources.
------+ MASVS-PRIVACY-2 The app prevents identification of the user.
------+ MASVS-PRIVACY-3 The app is transparent about data collection and usage.
------+ MASVS-PRIVACY-4 The app offers user control over their data.

OWASP Software Assurance Maturity Model (SAMM) v2.2.0

Ticket
+ OWASP Software Assurance Maturity Model (SAMM) v2.2.0
---+ Governance
------+ G-SM Strategy and Metrics
---------+ G-SM-A Stream A: Create and Promote
------------+ G-SM-1-A Identify the organization's risk appetite
------------+ G-SM-2-A Define the security strategy
------------+ G-SM-3-A Align security and business strategies
---------+ G-SM-B Stream B: Measure and Improve
------------+ G-SM-1-B Define basic security metrics
------------+ G-SM-2-B Set strategic KPIs
------------+ G-SM-3-B Drive the security program through metrics
------+ G-PC Policy and Compliance
---------+ G-PC-A Stream A: Policy and Standards
------------+ G-PC-1-A Define policies and standards
------------+ G-PC-2-A Develop test procedures
------------+ G-PC-3-A Measure compliance to policies and standards
---------+ G-PC-B Stream B: Compliance Management
------------+ G-PC-1-B Identify compliance requirements
------------+ G-PC-2-B Standardize policy and compliance requirements
------------+ G-PC-3-B Measure compliance to external requirements
------+ G-EG Education and Guidance
---------+ G-EG-A Stream A: Training and Awareness
------------+ G-EG-1-A Train all stakeholders for awareness
------------+ G-EG-2-A Customize security training
------------+ G-EG-3-A Standardize security guidance
---------+ G-EG-B Stream B: Organization and Culture
------------+ G-EG-1-B Identify security champions
------------+ G-EG-2-B Implement centers of excellence
------------+ G-EG-3-B Establish a security community
---+ Design
------+ D-TA Threat Assessment
---------+ D-TA-A Stream A: Application Risk Profile
------------+ D-TA-1-A Perform application risk assessments
------------+ D-TA-2-A Inventory risk profiles
------------+ D-TA-3-A Periodic review of risk profiles
---------+ D-TA-B Stream B: Threat Modeling
------------+ D-TA-1-B Perform basic threat modeling
------------+ D-TA-2-B Standardize and scale threat modeling
------------+ D-TA-3-B Optimize threat modeling
------+ D-SR Security Requirements
---------+ D-SR-A Stream A: Software Requirements
------------+ D-SR-1-A Identify security requirements
------------+ D-SR-2-A Standardize and integrate security requirements
------------+ D-SR-3-A Develop a security requirements framework
---------+ D-SR-B Stream B: Supplier Security
------------+ D-SR-1-B Perform vendor assessments
------------+ D-SR-2-B Discuss security responsibilities with suppliers
------------+ D-SR-3-B Align security methodology with suppliers
------+ D-SA Secure Architecture
---------+ D-SA-A Stream A: Architecture Design
------------+ D-SA-1-A Adhere to basic security principles
------------+ D-SA-2-A Provide preferred security solutions
------------+ D-SA-3-A Build reference architectures
---------+ D-SA-B Stream B: Technology Management
------------+ D-SA-1-B Identify tools and technologies
------------+ D-SA-2-B Promote preferred tools and technologies
------------+ D-SA-3-B Enforce the use of recommended technologies
---+ Implementation
------+ I-SB Secure Build
---------+ I-SB-A Stream A: Build Process
------------+ I-SB-1-A Define a consistent build process
------------+ I-SB-2-A Automate the build process
------------+ I-SB-3-A Enforce a security baseline during build
---------+ I-SB-B Stream B: Software Dependencies
------------+ I-SB-1-B Identify application dependencies
------------+ I-SB-2-B Review application dependencies for security
------------+ I-SB-3-B Test application dependencies
------+ I-SD Secure Deployment
---------+ I-SD-A Stream A: Deployment Process
------------+ I-SD-1-A Use a repeatable deployment process
------------+ I-SD-2-A Automate deployment and integrate security checks
------------+ I-SD-3-A Verify the integrity of deployment artifacts
---------+ I-SD-B Stream B: Secret Management
------------+ I-SD-1-B Protect application secrets in configuration and code
------------+ I-SD-2-B Include application secrets during deployment
------------+ I-SD-3-B Enforce lifecycle management of application secrets
------+ I-DM Defect Management
---------+ I-DM-A Stream A: Defect Tracking
------------+ I-DM-1-A Track security defects centrally
------------+ I-DM-2-A Rate and track security defects
------------+ I-DM-3-A Enforce an SLA for defect management
---------+ I-DM-B Stream B: Metrics and Feedback
------------+ I-DM-1-B Define basic defect metrics
------------+ I-DM-2-B Define advanced defect metrics
------------+ I-DM-3-B Use metrics to improve the security strategy
---+ Verification
------+ V-AA Architecture Assessment
---------+ V-AA-A Stream A: Architecture Validation
------------+ V-AA-1-A Assess application architecture
------------+ V-AA-2-A Verify the application architecture for security methodically
------------+ V-AA-3-A Verify the effectiveness of security components
---------+ V-AA-B Stream B: Architecture Mitigation
------------+ V-AA-1-B Evaluate architecture for typical threats
------------+ V-AA-2-B Structurally verify the architecture for identified threats
------------+ V-AA-3-B Feed review results back to improve reference architectures
------+ V-RT Requirements-driven Testing
---------+ V-RT-A Stream A: Control Verification
------------+ V-RT-1-A Test the effectiveness of security controls
------------+ V-RT-2-A Define and run security test cases from requirements
------------+ V-RT-3-A Automate security requirements testing
---------+ V-RT-B Stream B: Misuse/Abuse Testing
------------+ V-RT-1-B Perform fuzz testing
------------+ V-RT-2-B Define and run security abuse cases from requirements
------------+ V-RT-3-B Perform security stress testing
------+ V-ST Security Testing
---------+ V-ST-A Stream A: Scalable Baseline
------------+ V-ST-1-A Perform automated security testing
------------+ V-ST-2-A Develop application-specific security test cases
------------+ V-ST-3-A Integrate security testing tools in the delivery pipeline
---------+ V-ST-B Stream B: Deep Understanding
------------+ V-ST-1-B Test high risk application components manually
------------+ V-ST-2-B Establish a penetration testing process
------------+ V-ST-3-B Establish continuous, scalable security verification
---+ Operations
------+ O-IM Incident Management
---------+ O-IM-A Stream A: Incident Detection
------------+ O-IM-1-A Use best-effort incident detection
------------+ O-IM-2-A Define an incident detection process
------------+ O-IM-3-A Improve the incident detection process
---------+ O-IM-B Stream B: Incident Response
------------+ O-IM-1-B Create an incident response plan
------------+ O-IM-2-B Define an incident response process
------------+ O-IM-3-B Establish an incident response team
------+ O-EM Environment Management
---------+ O-EM-A Stream A: Configuration Hardening
------------+ O-EM-1-A Use best-effort hardening
------------+ O-EM-2-A Establish hardening baselines
------------+ O-EM-3-A Perform continuous configuration monitoring
---------+ O-EM-B Stream B: Patching and Updating
------------+ O-EM-1-B Practice best-effort patching
------------+ O-EM-2-B Formalize patch management
------------+ O-EM-3-B Enforce timely patch management
------+ O-OM Operational Management
---------+ O-OM-A Stream A: Data Protection
------------+ O-OM-1-A Organize basic data protections
------------+ O-OM-2-A Establish a data catalog
------------+ O-OM-3-A Respond to data breaches
---------+ O-OM-B Stream B: System Decommissioning / Legacy Management
------------+ O-OM-1-B Identify unused applications
------------+ O-OM-2-B Formalize decommissioning process
------------+ O-OM-3-B Review application lifecycle state regularly
---+ SAMM Assessment Questions
------+ G-SM-1-A Do you understand the enterprise-wide risk appetite for your applications?
------+ G-SM-2-A Do you have a strategic plan for application security and use it to make decisions?
------+ G-SM-3-A Do you regularly review and update the Strategic Plan for Application Security?
------+ G-SM-1-B Do you use a set of metrics to measure the effectiveness and efficiency of the application security program across applications?
------+ G-SM-2-B Have you defined Key Performance Indicators (KPIs) from available application security metrics?
------+ G-SM-3-B Do you update the Application Security strategy and roadmap based on application security metrics and KPIs?
------+ G-PC-1-A Do you have and apply a common set of policies and standards throughout your organization?
------+ G-PC-2-A Do you publish the organization's policies as test scripts or run-books for easy interpretation by development teams?
------+ G-PC-3-A Do you regularly report on policy and standard compliance, and use that information to guide compliance improvement efforts?
------+ G-PC-1-B Do you have a complete picture of your external compliance obligations?
------+ G-PC-2-B Do you have a standard set of security requirements and verification procedures addressing the organization's external compliance obligations?
------+ G-PC-3-B Do you regularly report on adherence to external compliance obligations and use that information to guide efforts to close compliance gaps?
------+ G-EG-1-A Do you require employees involved with application development to take SDLC training?
------+ G-EG-2-A Is training customized for individual roles such as developers, testers, or security champions?
------+ G-EG-3-A Have you implemented a Learning Management System or equivalent to track employee training and certification processes?
------+ G-EG-1-B Have you identified a Security Champion for each development team?
------+ G-EG-2-B Does the organization have a Secure Software Center of Excellence (SSCE)?
------+ G-EG-3-B Is there a centralized portal where developers and application security professionals from different teams and business units are able to communicate and share information?
------+ D-TA-1-A Do you classify applications according to business risk based on a simple and predefined set of questions?
------+ D-TA-2-A Do you use centralized and quantified application risk profiles to evaluate business risk?
------+ D-TA-3-A Do you regularly review and update the risk profiles for your applications?
------+ D-TA-1-B Do you identify and manage architectural design flaws with threat modeling?
------+ D-TA-2-B Do you use a standard methodology, aligned with your application risk levels?
------+ D-TA-3-B Do you regularly review and update the threat modeling methodology for your applications?
------+ D-SR-1-A Do project teams specify security requirements during development?
------+ D-SR-2-A Do you define, structure, and include prioritization in the artifacts of the security requirements gathering process?
------+ D-SR-3-A Do you use a standard requirements framework to streamline the elicitation of security requirements?
------+ D-SR-1-B Do stakeholders review vendor collaborations for security requirements and methodology?
------+ D-SR-2-B Do vendors meet the security responsibilities and quality measures of service level agreements defined by the organization?
------+ D-SR-3-B Are vendors aligned with standard security controls and software development tools and processes that the organization utilizes?
------+ D-SA-1-A Do teams use security principles during design?
------+ D-SA-2-A Do you use shared security services during design?
------+ D-SA-3-A Do you base your design on available reference architectures?
------+ D-SA-1-B Do you evaluate the security quality of important technologies used for development?
------+ D-SA-2-B Do you have a list of recommended technologies for the organization?
------+ D-SA-3-B Do you enforce the use of recommended technologies within the organization?
------+ I-SB-1-A Is your full build process formally described?
------+ I-SB-2-A Is the build process fully automated?
------+ I-SB-3-A Do you enforce automated security checks in your build processes?
------+ I-SB-1-B Do you have solid knowledge of the dependencies you rely on?
------+ I-SB-2-B Do you handle third-party dependency risk through a formal process?
------+ I-SB-3-B Do you prevent the build of software if it is affected by vulnerabilities in dependencies?
------+ I-SD-1-A Do you use repeatable deployment processes?
------+ I-SD-2-A Are deployment processes automated and employing security checks?
------+ I-SD-3-A Do you consistently validate the integrity of deployed artifacts?
------+ I-SD-1-B Do you limit access to application secrets according to the least privilege principle?
------+ I-SD-2-B Do you inject production secrets into configuration files during deployment?
------+ I-SD-3-B Do you practice proper lifecycle management for application secrets?
------+ I-DM-1-A Do you track all known security defects in accessible locations?
------+ I-DM-2-A Do you keep an overview of the state of security defects across the organization?
------+ I-DM-3-A Do you enforce SLAs for fixing security defects?
------+ I-DM-1-B Do you use basic metrics about recorded security defects to carry out quick-win improvement activities?
------+ I-DM-2-B Do you improve your security assurance program upon standardized metrics?
------+ I-DM-3-B Do you regularly evaluate the effectiveness of your security metrics so that their input helps drive your security strategy?
------+ V-AA-1-A Do you review the application architecture for key security objectives on an ad-hoc basis?
------+ V-AA-2-A Do you regularly review the security mechanisms of your architecture?
------+ V-AA-3-A Do you regularly review the effectiveness of the security controls?
------+ V-AA-1-B Do you review the application architecture for mitigations of typical threats on an ad-hoc basis?
------+ V-AA-2-B Do you regularly evaluate the threats to your architecture?
------+ V-AA-3-B Do you regularly update your reference architectures based on architecture assessment findings?
------+ V-RT-1-A Do you test applications for the correct functioning of standard security controls?
------+ V-RT-2-A Do you consistently write and execute test scripts to verify the functionality of security requirements?
------+ V-RT-3-A Do you automatically test applications for security regressions?
------+ V-RT-1-B Do you test applications using randomization or fuzzing techniques?
------+ V-RT-2-B Do you create abuse cases from functional requirements and use them to drive security tests?
------+ V-RT-3-B Do you perform denial of service and security stress testing?
------+ V-ST-1-A Do you scan applications with automated security testing tools?
------+ V-ST-2-A Do you customize the automated security tools to your applications and technology stacks?
------+ V-ST-3-A Do you integrate automated security testing into the build and deploy process?
------+ V-ST-1-B Do you manually review the security quality of selected high-risk components?
------+ V-ST-2-B Do you perform penetration testing for your applications at regular intervals?
------+ V-ST-3-B Do you use the results of security testing to improve the development lifecycle?
------+ O-IM-1-A Do you analyze log data for security incidents periodically?
------+ O-IM-2-A Do you follow a documented process for incident detection?
------+ O-IM-3-A Do you review and update the incident detection process regularly?
------+ O-IM-1-B Do you respond to detected incidents?
------+ O-IM-2-B Do you use a repeatable process for incident handling?
------+ O-IM-3-B Do you have a dedicated incident response team available?
------+ O-EM-1-A Do you harden configurations for key components of your technology stacks?
------+ O-EM-2-A Do you have hardening baselines for your components?
------+ O-EM-3-A Do you monitor and enforce conformity with hardening baselines?
------+ O-EM-1-B Do you identify and patch vulnerable components?
------+ O-EM-2-B Do you follow an established process for updating components of your technology stacks?
------+ O-EM-3-B Do you regularly evaluate components and review patch level status?
------+ O-OM-1-A Do you protect and handle information according to protection requirements for data stored and processed on each application?
------+ O-OM-2-A Do you maintain a data catalog, including types, sensitivity levels, and processing and storage locations?
------+ O-OM-3-A Do you regularly review and update the data catalog and your data protection policies and procedures?
------+ O-OM-1-B Do you identify and remove systems, applications, application dependencies, or services that are no longer used, have reached end of life, or are no longer actively developed or supported?
------+ O-OM-2-B Do you follow an established process for removing all associated resources, as part of decommissioning of unused systems, applications, application dependencies, or services?
------+ O-OM-3-B Do you regularly evaluate the lifecycle state and support status of every software asset and underlying infrastructure component, and estimate their end of life?

OWASP Top 10:2025

Ticket
+ OWASP Top 10:2025
---+ A01:2025 Broken Access Control
---+ A02:2025 Security Misconfiguration
---+ A03:2025 Software Supply Chain Failures
---+ A04:2025 Cryptographic Failures
---+ A05:2025 Injection
---+ A06:2025 Insecure Design
---+ A07:2025 Authentication Failures
---+ A08:2025 Software or Data Integrity Failures
---+ A09:2025 Security Logging & Alerting Failures
---+ A10:2025 Mishandling of Exceptional Conditions