Skip to content

Latest commit

 

History

History
166 lines (103 loc) · 7.65 KB

cheatsheet-asvs-mapping.md

File metadata and controls

166 lines (103 loc) · 7.65 KB

Rules Possible:

These are rules which can be directly linked to secure code snippets within the Cheat Sheets. Rules should be relatively easier to write and should be tackled first.

V3.4 Cookie-based Session Management
V3.5 Token-based Session Management
V4.2 Operation Level Access Control
V5: Validation, Sanitization and Encoding Verification Requirements:
V5.2 Sanitization and Sandboxing Requirements:
V5.3 Output encoding and Injection Prevention Requirements
V5.5 Deserialization Prevention Requirements
V7.4 Error Handling
V9.1 Communications Security Requirements
V10.1 Code Integrity Controls
V12.6 SSRF Protection Requirements
V14.3 Unintended Security Disclosure Requirements
V14.4 HTTP Security Headers Requirements

Rules Recommend Solution

Rules which can also have a secure wrapper/library that can be recommended to use e.g. DOMPurify.

V4.2 Operation Level Access Control
V5.3 Output encoding and Injection Prevention Requirements
V7.1 Log Content Requirements
V7.2 Log Processing Requirements
V7.3 Log Protection Requirements
V12.1 File Upload Requirements

Rules Org/Team/Technology Stack Dependent:

This is a little tricker, as rules are possible but very much dependent on the security team/org approach. Perhaps this would be more of a community effort and secure patterns that have already found success.

V1.7 Errors, Logging and Auditing Architectural Requirements
V1.11 Business Logic Architectural Requirements
V1.13 API Architectural Requirements
V3.5 Token-based Session Management
V3.7 Defenses Against Session Management Exploits
V4.1 General Access Control Design
V5: Validation, Sanitization and Encoding Verification Requirements:
V5.2 Sanitization and Sandboxing Requirements:
V5.3 Output encoding and Injection Prevention Requirements
V6.2 Algorithms
V6.4 Secret Management
V7.1 Log Content Requirements
V7.2 Log Processing Requirements
V7.3 Log Protection Requirements
V12.6 SSRF Protection Requirements
V13.2 RESTful Web Service Verification Requirements
V14.4 HTTP Security Headers Requirements