simpl.
Anmelden
Cybersicherheits-GRC 15 Punkte

Web Application Security Assessment (OWASP Top 10)

Diese Checkliste ist auf Englisch.

Assesses a web application against the OWASP Top 10 (2021) risk categories and core application security controls.

OWASP Top 10OWASP ASVSCIS v8

Kostenlos als PDF oder Word · E-Mail-Adresse eingeben und herunterladen.

Access Control & Authentication

  • Are authorization checks enforced server-side for every request? *
  • Are insecure direct object references prevented through ownership checks? *
  • Are authentication controls resistant to credential stuffing and brute force? *
  • Are session tokens securely generated, rotated, and invalidated on logout? *

Injection & Data Handling

  • Are parameterized queries or ORMs used to prevent SQL injection? *
  • Is output encoding applied to prevent cross-site scripting (XSS)? *
  • Is server-side input validation enforced on all untrusted input? *
  • Are SSRF protections applied to server-initiated requests?

Cryptography & Configuration

  • Is sensitive data encrypted in transit (TLS) and at rest? *
  • Are security headers (CSP, HSTS) and secure defaults configured? *
  • Are error messages sanitized to avoid leaking sensitive details? *
  • Is the application designed with documented threat modeling?

Components, Integrity & Logging

  • Are third-party components inventoried and scanned for known vulnerabilities? *
  • Is the integrity of updates, plugins, and CI/CD artifacts verified? *
  • Are security-relevant events logged and monitored for the application? *

Vollständige Checkliste Web Application Security Assessment (OWASP Top 10) herunterladen

Kostenlos als übersichtliches, druckfertiges PDF oder als bearbeitbares Word-Dokument.