Automating Security Test Cases Based On ASVS
summary
The work analyzes 278 ASVS v4 requirements and concludes roughly ~2/3 automatable (~170–189 requirements) by unit, integration, acceptance or tooling approaches. A practical run implements 90 tests in 10 man-days against a Symfony PHP SaaS: 65 fully implemented, 25 partial; the 90 use code-level unit/integration tests (no SAST/DAST used for that set). Tests run in CI, fail builds on regressions, and some requirements remain manual or tool‑dependent.
AI-written summary · about
chapters (13)
- 0:00Introduction to app security
- 1:34Leveraging OWASP SAM
- 2:23Start with ASVS
- 5:59Implementation challenges
- 6:39Shifting left with testing
- 9:38ASVS research findings
- 13:42Examples of test coverage
- 16:54Results and methodology
- 19:35Practical experiment results
- 25:19Pipeline integration
- 25:39Conclusion of experiment
- 26:15Key takeaways and advice
- 29:18Q&A session
related talks
45mMaturing Your Application Security Program with ASVS-Driven Development
55mBuilding a sustainable security requirements process with the ASVS
39mHandling of Security Requirements in Software Development Lifecycle
35mGetting benefits of OWASP ASVS at initial phases
55mASVS Project
38mLeveraging the ASVS in the Secure SDLC
46mAutomating Security Testing with Functional Testing Test Cases
49mMan vs Machine: manual and automated security testing