ASVS Testing: You Keep Using Those Words

Slides: https://static.sched.com/hosted_files/owasp2023globalappsecwashin/08/Shanni%20Prutchi%20-%20You%20Keep%20Using%20Those%20Words.pdf

As the Application Security Verification Standard (ASVS) grows in popularity, companies have an increasing interest in assessing the security of their web applications against the verification requirements outlined in the ASVS. Although the standard itself claims that all the requirements can be verified through penetration testing, source code, system configuration, documentation, and access to application developers, some companies are not willing to accept documentation and attestation by developers as legitimate evidence for verification, as the veracity of their …

access application application developers applications application security asvs can claims code companies configuration developers documentation interest penetration penetration testing requirements security source code standard system testing verification verified web web applications