OWASP ASVS is a great project to provide a framework of security controls for design and define the basis of secure development.

But the problem is when you decide to use these checks in your organization, you end up with a 71-page pdf file or an OWASP ASVS checklist (excel sheet).

It is incredibly hard for organizations to adapt and spread the word within the company.

This is why we decided to implement a feature that gets all the security testing tools results (by CWE) and maps them into OWASP ASVS automatically so you can use it in every aspect of your application security program.

How to use OWASP ASVS with Kondukto?

You can use this self-guided demo to see exactly how you can map all your security testing tool results into OWASP ASVS in Kondukto.

What's in OWASP ASVS?

OWASP ASVS (Application Security Verification Standard) is a great framework for developers to follow secure development practices and have technical security controls.

The latest version (OWASP ASVS 4.0.3) was released on October 2021.

How OWASP ASVS works?

It starts with the assessment of the business criticality of applications, and there are three security verification levels in OWASP ASVS 4:

• ASVS Level 1 is for low assurance levels and is completely penetration testable.
• ASVS Level 2 is for applications that contain sensitive data, which requires protection and is the recommended level for most apps.
• ASVS Level 3 is for the most critical applications – applications that perform high-value transactions, contain sensitive medical data, or any application that requires the highest level of trust.

Each ASVS level contains a list of security requirements mapped to security-specific features and capabilities.

What is the benefit of using OWASP ASVS?

Let us dive into the details of the benefits of OWASP ASVS Framework for organizations:

1- A baseline to measure your security posture

OWASP ASVS has great coverage with each aspect of application security; It will make it clear where you are at the moment. You will have a baseline for each project, which gives you enough data to see the trends and benchmarks in time.

2- A guide for your security roadmap

Now you know what is missing, and you will have a pretty good idea of where to start.

This framework will categorize all the security issues in your applications, and you will start to catch patterns to improve security practices in your organization.

3- Help you to be more proactive

In general, actions you take in application security are more about finding the existing vulnerabilities and how to solve them. However, with OWASP ASVS, you can start doing it right before, even before the first line of code.

You will have clear guidelines of what to do and not do, so you will be prepared.