OWASP Application Security Verification Standard (ASVS)
summary
Standard currently lists about 278 controls across 14 topics and keeps level one almost entirely pen‑testable; version 5.0 aims to ship a candidate v5 before year end, adds three new chapters (web frontend, OAuth2, WebRTC), streamlines wording and moves mappings toward OWASP CR to reduce maintenance, and clarifies level definitions so fewer level‑one items feel misclassified. Release is on GitHub, issues are active, and contribution steps include watching issues, filing PRs, or using the quickstart guide to submit changes.
AI-written summary · about
chapters (13)
- 0:00OWASP ASVS introduction
- 1:48What is ASVS
- 5:27ASVS use cases and levels
- 7:54ASVS v5 improvements
- 12:14ASVS v5 timeline
- 13:21Contributing to ASVS
- 19:19Supporting ASVS financially
- 21:05Personal ASVS journey
- 24:15Pentestable vs non-pentestable controls
- 25:18ASVS and other OWASP projects
- 28:24Filtering ASVS controls
- 31:52Community feedback and future
- 33:07Reviewing ASVS v5 changes
related talks
39mIntroducing the ASVS 4.0
24mFlagship Projects: Application Security Verification Standard
35mGetting benefits of OWASP ASVS at initial phases
45mWhat's New in ASVS V5
38mLeveraging the ASVS in the Secure SDLC
52mAppSec: From the OWASP Top Ten(s) to the OWASP ASVS
55mASVS Project
01h 02mFrom the OWASP Top Ten(s) to the OWASP ASVS