From the OWASP Top Ten(s) to the OWASP ASVS

on YouTube ↗41m

" summary

Compares the OWASP Top Ten 2017 and Proactive Controls 2018 to ASVS v3.1 and shows concrete requirements not platitudes: over 150 requirements across 16 categories and three security levels, examples include 2.13 password storage (use bcrypt/Argon2 with work factors, pcrypt yields ~390 hashes/sec), 2.31 offering TOTP multi-factor, and 2.28 timing attack fixes by computing a fake bcrypt on missing users. Emphasizes automatable level 1 tests, S3 misconfiguration incidents (73 GB leak) and practical prioritization.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 6:04AWARENESS
3. 28:40AUTOMATED SECURITY TESTING
4. 38:29FORK AND CUSTOMIZE

" related talks

• 01h 02mFrom the OWASP Top Ten(s) to the OWASP ASVSJim Manico · NDC London 2020
• 58m: The OWASP Top Ten Proactive Controls 2018Jim Manico · NDC London 2020
• 52mAppSec: From the OWASP Top Ten(s) to the OWASP ASVSJim Manico · GOTO Chicago 2019
• 39mIntroducing the ASVS 4.0Andrew van der Stock · nullcon Goa 2019
• 35mGetting benefits of OWASP ASVS at initial phasesOleksandr Kazymyrov · NDC Oslo 2018
• 47mOWASP Top 10Andrew van der Stock · OWASP AppSec California 2018
• 43mFrom OWASP top 10 to Secure ApplicationsRoberto Velasco · Spring I/O 2019
• 35mOWASP Application Security Verification Standard (ASVS)Ryan Armstrong, Shanni Prutchi · OWASP Global AppSec San Francisco 2024