Introducing the ASVS 4.0
summary
OWASP ASVS 4.0 is published on GitHub, renumbers every control and raises the baseline to 167 level 1 controls that are pen-testable, makes secure SDLC and threat modeling mandatory prerequisites, and mandates 12‑character minimum passwords with MFA and password‑manager support. It adds explicit checks for JWT, SSRF, XXE, template injection, GraphQL and subdomain takeover, moves content to Markdown with CSV export for tool integration, and ships as an open repo for contributions.
AI-written summary · about
chapters (25)
- 0:00Intro
- 0:14Andrew van der Stock
- 0:58What is the ASVS?
- 4:30Who is involved?
- 6:31What's new
- 8:32Modern web applications
- 10:42What's changed
- 12:12is the new minimum
- 14:14PCI DSS 6.5.x
- 15:00What's gone
- 15:38V1 Architecture
- 17:08Authentication
- 20:42Session Management
- 23:01Access Control
- 23:50Stored Cryptography
- 24:27Error handling
- 25:15Data Protection
- 26:17Communications Security
- 27:26Malicious Code
- 27:58Business Logic Verification
- 30:24Files and Resources
- 30:50API Security
- 31:38Configuration
- 33:14Generally Accepted Security Practices
- 36:56How to get involved
related talks
35mOWASP Application Security Verification Standard (ASVS)
55mASVS Project
41mFrom the OWASP Top Ten(s) to the OWASP ASVS
35mGetting benefits of OWASP ASVS at initial phases
45mWhat's New in ASVS V5
52mAppSec: From the OWASP Top Ten(s) to the OWASP ASVS
01h 02mFrom the OWASP Top Ten(s) to the OWASP ASVS
24mFlagship Projects: Application Security Verification Standard