GRC в кибербезопасности Пунктов: 15
Web Application Security Assessment (OWASP Top 10)
Этот чек-лист на английском языке.
Assesses a web application against the OWASP Top 10 (2021) risk categories and core application security controls.
OWASP Top 10OWASP ASVSCIS v8
Бесплатно в PDF или Word · укажите email, чтобы скачать.
Access Control & Authentication
- Are authorization checks enforced server-side for every request? *
- Are insecure direct object references prevented through ownership checks? *
- Are authentication controls resistant to credential stuffing and brute force? *
- Are session tokens securely generated, rotated, and invalidated on logout? *
Injection & Data Handling
- Are parameterized queries or ORMs used to prevent SQL injection? *
- Is output encoding applied to prevent cross-site scripting (XSS)? *
- Is server-side input validation enforced on all untrusted input? *
- Are SSRF protections applied to server-initiated requests?
Cryptography & Configuration
- Is sensitive data encrypted in transit (TLS) and at rest? *
- Are security headers (CSP, HSTS) and secure defaults configured? *
- Are error messages sanitized to avoid leaking sensitive details? *
- Is the application designed with documented threat modeling?
Components, Integrity & Logging
- Are third-party components inventoried and scanned for known vulnerabilities? *
- Is the integrity of updates, plugins, and CI/CD artifacts verified? *
- Are security-relevant events logged and monitored for the application? *
Скачайте полный чек-лист «Web Application Security Assessment (OWASP Top 10)»
Получите его бесплатно в виде аккуратного PDF для печати или редактируемого документа Word.