Jim Manico - The OWASP ASVS as the basis for a security program

Oct 14, 2026

Upload by nayy☆

Overview of OWASP Application Security Verification Standard, February 2019 update, authored by Jim Manico, including his OWASP roles and background. Frames OWASP as a worldwide not-for-profit focused on making software security risks visible and freely available. Discusses the OWASP Top Ten as an awareness resource, clarifying it is not a standard and is not comprehensive nor focused on remediation. Introduces OWASP ASVS 4.0 as a developer-driven application security standard, defining three risk levels and 200+ controls with a reference to ISO 27034.

LanguageEnglish

CategoryGeneral

FormatPDF

Pages37

Reading Time13 min

AccessFree to download

OWASP Application Security Verification Standard (February 2019 Update)

OWASP mission and open materials

OWASP Top Ten: purpose and limitations

OWASP ASVS 4.0 as a security program basis

OWASP Application Security Verification Standard February 2019 Update Jim Manico • Former OWASP Board Member • OWASP ASVS Lead Author • OWASP Proactive Controls Lead Author • OWASP Cheatsheet Series Project Manager • Kauai, Hawaii Resident Analysis Operations Design Testing Implementation Secure SDLC COPYRIGHT ©2019 MANICODE SECURITY Microsoft SDL for waterfall Microsoft SDL for Agile The Open Web Application Security Project (OWASP) is a 501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of software . Our mission is to make software security visible, so that individuals and organizations worldwide can make informed decisions about true software security risks . Everyone is free to participate in OWASP and all of our materials are available under a free and open software license . You'll find everything about OWASP linked from our wiki and current information on our OWASP Blog. [https://owasp.org](https://owasp.org) The OWASP Top Ten The Good § Project members include a variety of security experts from around the world who have shared their expertise to produce this list. – Andrew van der Stock – Neil Smithline – Torsten Gigler – Brian Glas § Significant public comments and conversation on Top Ten 2017 choices [https://github.com/OWASP/Top10/tree/master/2017](https://github.com/OWASP/Top10/tree/master/2017) § Frequently cited application security awareness document The OWASP Top Ten Struggles § The OWASP Ten has a history of vendor shenanigans that dates back a decade . § The OWASP Top 10 list is meant to spread awareness regarding Web Security issues . It is not a standard. I'm looking at you PCI-DSS and others who incorrectly list it as so. § The OWASP Top Ten is not a comprehensive list of web security risks . § The OWASP Top Ten does not go into detail about how to fix or prevent these issues . So what standard can we use for web applications and webservice security? OWASP ASVS 4.0! § First application security standard by developers for developers! § Defines three risk levels with 200+ controls . § Similar to ISO 27034 § To be released in under 2 weeks! § [https://github.com/OWASP/A](https://github.com/OWASP/A)[SVS/tree/master/4.0/en](SVS/tree/master/4.0/en)

FAQs

What is OWASP ASVS and why is it introduced in this document?

OWASP ASVS is presented as a developer-driven application security standard that can serve as a basis for a security program. It defines risk levels and a large set of controls for application security verification.

How does the document describe the OWASP Top Ten?

The OWASP Top Ten is described as a security awareness document about web security issues. The document stresses it is not a standard, is not comprehensive, and does not provide detailed instructions to fix or prevent issues.

What key capabilities does OWASP ASVS 4.0 provide?

OWASP ASVS 4.0 is described as defining three risk levels and including 200+ controls. It is also noted as being similar to ISO 27034.

Oct 14, 2026

Upload by nayy☆