GRC Cybersécurité 15 points
Web Application Security Assessment (OWASP Top 10)
Cette liste de contrôle est en anglais.
Assesses a web application against the OWASP Top 10 (2021) risk categories and core application security controls.
OWASP Top 10OWASP ASVSCIS v8
PDF ou Word gratuit · saisissez votre e-mail pour le télécharger.
Access Control & Authentication
- Are authorization checks enforced server-side for every request? *
- Are insecure direct object references prevented through ownership checks? *
- Are authentication controls resistant to credential stuffing and brute force? *
- Are session tokens securely generated, rotated, and invalidated on logout? *
Injection & Data Handling
- Are parameterized queries or ORMs used to prevent SQL injection? *
- Is output encoding applied to prevent cross-site scripting (XSS)? *
- Is server-side input validation enforced on all untrusted input? *
- Are SSRF protections applied to server-initiated requests?
Cryptography & Configuration
- Is sensitive data encrypted in transit (TLS) and at rest? *
- Are security headers (CSP, HSTS) and secure defaults configured? *
- Are error messages sanitized to avoid leaking sensitive details? *
- Is the application designed with documented threat modeling?
Components, Integrity & Logging
- Are third-party components inventoried and scanned for known vulnerabilities? *
- Is the integrity of updates, plugins, and CI/CD artifacts verified? *
- Are security-relevant events logged and monitored for the application? *
Téléchargez la liste de contrôle Web Application Security Assessment (OWASP Top 10) complète
Obtenez-la gratuitement en PDF propre et imprimable, ou en document Word modifiable.