What's New in ASVS V5
summary
ASVS v5 (first major release since 2021) reorganizes controls for code-level verification, rebalanced maturity levels (previously ~130 “must” checks crowded level 1), removes architecture/process requirements, and moves mappings into OpenCRE. New, testable sections include an encoding and sanitization chapter, dedicated OAuth/JWT guidance (demo shows missing JWT audience check), expanded race-condition coverage with four new requirements (time‑of‑check/time‑of‑use, deadlocks, mutex patterns, DB locks), and Appendix C recommending Argon2id for passwords.
AI-written summary · about
chapters (17)
- 0:00ASVS V5 introduction
- 3:07What is ASVS and use cases
- 7:40ASVS vs OWASP Top 10
- 10:05Key structural changes
- 11:51Rebalancing ASVS levels
- 13:59Dropping architecture chapter
- 16:03Verifiable requirements
- 18:50New chapters overview
- 19:10Encoding and sanitization updates
- 21:21Front-end security and JWT
- 24:07JWT validation gaps
- 27:20Race conditions demos
- 33:47ASVS in daily reviews
- 34:54Appendices C and D
- 37:23OWASP projects overview
- 41:14AI code generation relevance
- 43:01Q&A on ASVS levels
related talks
39mIntroducing the ASVS 4.0
35mOWASP Application Security Verification Standard (ASVS)
24mFlagship Projects: Application Security Verification Standard
41mFrom the OWASP Top Ten(s) to the OWASP ASVS
35mGetting benefits of OWASP ASVS at initial phases
55mASVS Project
38mLeveraging the ASVS in the Secure SDLC
52mAppSec: From the OWASP Top Ten(s) to the OWASP ASVS