OWASP ASVS Standard

Great to see the @OWASP_ASVS standard has been picked for the winter projects summit, congrats to all involved... I wouldn't mind a few days in Cancun, just saying https://owasp.org/www-staff/projects/202002-Projects-Summit-Q1 … cc: @dcuthbert

Dear @ring, your advice to Ring consumers is not great and not NIST 800-63 compliant. Please add breached password detection (i.e. clients who use breached passwords are asked to change), and remove password rotation (it doesn't work!) Source: I co-lead @OWASPTop10 & @OWASP_ASVShttps://twitter.com/ring/status/1205217267748761600 …

As custodians of sensitive vulnerability reports, I’d have expected far better appsec practices. This is stuff I’d have expected at the turn of the century, not 2019. Ideally your web apps should be, at a minimum, @OWASP_ASVS Level 2 compliant.

The @OWASPTop10 2020 will be starting later this year. We need data, as does @OWASP_ASVS, @OWASPControls and everything that MUST use evidence to justify choice or efficacy of controls. I am creating “@owasp Data Science Project” to collect and analyze data. Who wants in? RT pls

I started to read your comment and was saying to myself "so his presentations are after he removed 7-26 wooooo I need to talk to him" Your last paragraph fixed that impression Yet, your presentation are always super awesome!

I found a similar vulnerability at a client a couple years back when i helped a dev do a review against @OWASP_ASVS! Found and fixed well before release.https://twitter.com/PhilippeDeRyck/status/1189476034065899521 …

I'm presenting about the @OWASP_ASVS at the @OWASP_IL meeting next week. Similar talk to @OWASPHelsinki except I have half the time and I have also completely reworked the slides and changed the focus of the talk :)

Learning GraphQL: Declarative Data Fetching for Modern Web Apps by @eveporcello and Programming TypeScript: Making Your JavaScript Applications Scale by @bcherny I skipped GraphQL and TypeScript days at the brain gym, and we're starting to see a ton more of this stuff

My son is already so excited for @defcon next year. He told me he wants to meet “That crazy Japanese guy and the cactus dude you told me about but also the hugs guy and the rapper who does the hack all the things song.” @elkentaro @d4rkm4tter @jaysonstreet @dualcoremusic

Any members of the @OWASP_ASVS, @zaproxy @Owasp_DevSlop, or @owaspamass teams interested in leading a session at the @PortlandOWASP training day sept 25th? DM me.

Ah the glorious @vanderaj is the ASVS lead and an amazing one, too!

And if you are looking for an application security standard, consider the @OWASP_ASVS :)

Found some cool bugs in Firefox using behavioural fuzzing <!-[0x00]- ><div title="--><img src=1 onerror=alert(1)>"></div> <svg><script>&#x10fffe;alert&#x10fffe(1)&#x10fffe</script></svg>https://twitter.com/Burp_Suite/status/1133365676243070976 …

Folks - please stop sending clear text passwords to users. It's really, really not okay. @owasp_asvs 4.0 V2.5.1 "Verify that a system generated initial activation or recovery secret is not sent in clear text to the user." #staaaaaaaaahphttps://twitter.com/RoseSecOps/status/1125830282614136832 …

Creating a Secure SDLC is a process, not a project Creating a Secure SDLC is a process, not a project Creating a Secure SDLC is a process, not a project Creating a Secure SDLC is a process, not a project Creating a Secure SDLC is a process, not a project ...