Maturing Your Application Security Program with ASVS-Driven Development
summary
Claims that 162 ASVS requirements (58%) are automatable and that an experiment adding 98 ASVS items to sprint planning yields 90 ASVS tests implemented in 10 man‑days drive the decision. The team converts ASVS items into unit, integration and acceptance tests, runs them in CI as regression suites, tunes SAST/DAST/SCA where tests are impractical, and reports measurable coverage increases rather than vague process promises.
AI-written summary · about
chapters (13)
- 0:00Application security challenges
- 3:57Introduction
- 5:00SAMM limitations
- 7:51SAMM assessment challenges
- 10:18ASVS requirements framework
- 13:09Understanding ASVS
- 15:56Test-driven development
- 18:44ASVS-driven development
- 21:57ASVS test case feasibility
- 26:18Tool support for ASVS
- 30:32Implementation results
- 37:13Key takeaways
- 40:23Q&A
related talks
34mAutomating Security Test Cases Based On ASVS
55mBuilding a sustainable security requirements process with the ASVS
38mLeveraging the ASVS in the Secure SDLC
35mGetting benefits of OWASP ASVS at initial phases
39mHandling of Security Requirements in Software Development Lifecycle
24mFlagship Projects: Application Security Verification Standard
20mSecure Software Development Lifecycle
37mDeploying Security Testing Practice in Your Team and Company