Security requirements for web applications
The OWASP Application Security Verification Standard (ASVS) not only provides a list of security requirements that a development team should follow but can also be used as a checklist for a QA team to do verification and assess the security level of the application. Please refer to the project source at https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project.
OWASP Application Security Verification Standard (ASVS)
The OWASP ASVS defines the following security requirements at the time of writing, in 2018. Some section numbers were skipped because they were incorporated into other sections:
- ASVS V1 Architecture
- ASVS V2 Authentication
- ASVS V3 Session Management
- ASVS V4 Access Control
- ASVS V5 Input Validation and Output Encoding
- ASVS V7 Cryptography
- ASVS V8 Error Handling
- ASVS V9 Data Protection
- ASVS V10 Communications
- ASVS V13 Malicious Code
- ASVS V15 Business Logic Flaws
- ASVS V16 Files and Resources
- ASVS V17 Mobile
- ASVS V18...
