حوكمة ومخاطر وامتثال الأمن السيبراني (GRC) 15 بند
Web Application Security Assessment (OWASP Top 10)
قائمة التحقق هذه باللغة الإنجليزية.
Assesses a web application against the OWASP Top 10 (2021) risk categories and core application security controls.
OWASP Top 10OWASP ASVSCIS v8
PDF أو Word مجانًا · أدخل بريدك الإلكتروني للتنزيل.
Access Control & Authentication
- Are authorization checks enforced server-side for every request? *
- Are insecure direct object references prevented through ownership checks? *
- Are authentication controls resistant to credential stuffing and brute force? *
- Are session tokens securely generated, rotated, and invalidated on logout? *
Injection & Data Handling
- Are parameterized queries or ORMs used to prevent SQL injection? *
- Is output encoding applied to prevent cross-site scripting (XSS)? *
- Is server-side input validation enforced on all untrusted input? *
- Are SSRF protections applied to server-initiated requests?
Cryptography & Configuration
- Is sensitive data encrypted in transit (TLS) and at rest? *
- Are security headers (CSP, HSTS) and secure defaults configured? *
- Are error messages sanitized to avoid leaking sensitive details? *
- Is the application designed with documented threat modeling?
Components, Integrity & Logging
- Are third-party components inventoried and scanned for known vulnerabilities? *
- Is the integrity of updates, plugins, and CI/CD artifacts verified? *
- Are security-relevant events logged and monitored for the application? *
نزّل قائمة تحقق Web Application Security Assessment (OWASP Top 10) كاملة
احصل عليها مجانًا بصيغة PDF أنيقة قابلة للطباعة أو مستند Word قابل للتعديل.