-
Notifications
You must be signed in to change notification settings - Fork 287
/
Copy pathowasp-asvs-4.0.3.yaml
5908 lines (5908 loc) · 259 KB
/
owasp-asvs-4.0.3.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
urn: urn:intuitem:risk:library:owasp-asvs-4.0.3
locale: en
ref_id: OWASP-ASVS-4.0.3
name: OWASP ASVS 4.0.3
description: OWASP Application Security Verification Standard. https://owasp.org/www-project-application-security-verification-standard/
copyright: CC BY-SA 3.0 - The OWASP Foundation
publication_date: 2024-04-07
version: 3
provider: OWASP
packager: intuitem
translations:
fr:
name: OWASP ASVS 4.0.3
description: OWASP Application Security Verification Standard. https://owasp.org/www-project-application-security-verification-standard/
copyright: CC BY-SA 3.0 - The OWASP Foundation
provider: OWASP
objects:
framework:
urn: urn:intuitem:risk:framework:owasp-asvs-4.0.3
ref_id: OWASP-ASVS-4.0.3
name: OWASP ASVS 4.0.3
description: 'OWASP Application Security Verification Standard '
translations:
fr:
name: OWASP ASVS 4.0.3
description: 'OWASP Application Security Verification Standard '
implementation_groups_definition:
- ref_id: L1
name: Level 1
description: First steps, automated, or whole of portfolio view
- ref_id: L2
name: Level 2
description: Most applications
- ref_id: L3
name: Level 3
description: High value, high assurance, or high safety
requirement_nodes:
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1
assessable: false
depth: 1
ref_id: V1
name: Architecture, Design and Threat Modeling
translations:
fr:
name: "Architecture, conception et exigences en mati\xE8re de mod\xE9lisation\
\ des menaces"
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1
ref_id: V1.1
name: Secure Software Development Lifecycle
translations:
fr:
name: "Exigences relatives au cycle de vie du d\xE9veloppement de logiciels\
\ s\xE9curis\xE9s"
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1
ref_id: V1.1.1
description: Verify the use of a secure software development lifecycle that
addresses security in all stages of development. ([C1](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier l'utilisation d'un cycle de d\xE9veloppement de\
\ logiciel s\xE9curis\xE9 qui prend en compte la s\xE9curit\xE9 \xE0 tous\
\ les stades du d\xE9veloppement. ([C1](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1
ref_id: V1.1.2
description: Verify the use of threat modeling for every design change or sprint
planning to identify threats, plan for countermeasures, facilitate appropriate
risk responses, and guide security testing.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier l'utilisation de la mod\xE9lisation des menaces\
\ pour chaque modification de conception ou planification de sprint afin\
\ d'identifier les menaces, de planifier les contre-mesures, de faciliter\
\ les r\xE9ponses appropri\xE9es aux risques et d'orienter les tests de\
\ s\xE9curit\xE9."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1
ref_id: V1.1.3
description: Verify that all user stories and features contain functional security
constraints, such as "As a user, I should be able to view and edit my profile.
I should not be able to view or edit anyone else's profile"
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que toutes les r\xE9cits utilisateurs et les fonctionnalit\xE9\
s contiennent des contraintes de s\xE9curit\xE9 fonctionnelles, telles\
\ que \"En tant qu'utilisateur, je devrais pouvoir consulter et modifier\
\ mon profil. Je ne devrais pas pouvoir voir ou modifier le profil de\
\ quelqu'un d'autre\""
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1.4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1
ref_id: V1.1.4
description: Verify documentation and justification of all the application's
trust boundaries, components, and significant data flows.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier la documentation et la justification de toutes\
\ les fronti\xE8res de confiance de la demande, de ses composantes et\
\ des flux de donn\xE9es importants."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1.5
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1
ref_id: V1.1.5
description: Verify definition and security analysis of the application's high-level
architecture and all connected remote services. ([C1](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier la d\xE9finition et l'analyse de s\xE9curit\xE9\
\ de l'architecture de haut niveau de l'application et de tous les services\
\ \xE0 distance connect\xE9s. ([C1](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1.6
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1
ref_id: V1.1.6
description: Verify implementation of centralized, simple (economy of design),
vetted, secure, and reusable security controls to avoid duplicate, missing,
ineffective, or insecure controls. ([C10](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier la mise en \u0153uvre de contr\xF4les de s\xE9\
curit\xE9 centralis\xE9s, simples (\xE9conomie de conception), v\xE9rifi\xE9\
s, s\xE9curis\xE9s et r\xE9utilisables pour \xE9viter les contr\xF4les\
\ en double, manquants, inefficaces ou peu s\xFBrs. ([C10](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1.7
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.1
ref_id: V1.1.7
description: Verify availability of a secure coding checklist, security requirements,
guideline, or policy to all developers and testers.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier que tous les d\xE9veloppeurs et testeurs disposent\
\ d'une liste de contr\xF4le de codage s\xE9curis\xE9, d'exigences de\
\ s\xE9curit\xE9, de lignes directrices ou de politiques."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.2
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1
ref_id: V1.2
name: Authentication Architecture
translations:
fr:
name: Exigences architecturales d'authentification
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.2.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.2
ref_id: V1.2.1
description: Verify the use of unique or special low-privilege operating system
accounts for all application components, services, and servers. ([C3](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier que les communications entre les composants de\
\ l'application, y compris les API, les intergiciels et les couches de\
\ donn\xE9es, sont authentifi\xE9es et utilisent des comptes utilisateurs\
\ individuels. ([C3](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.2.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.2
ref_id: V1.2.2
description: Verify that communications between application components, including
APIs, middleware and data layers, are authenticated. Components should have
the least necessary privileges needed. ([C3](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que les communications entre les composants de\
\ l'application, y compris les API, le middleware et les couches de donn\xE9\
es, sont authentifi\xE9es. Les composants doivent avoir les privil\xE8\
ges les moins n\xE9cessaires possibles. ([C3](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.2.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.2
ref_id: V1.2.3
description: Verify that the application uses a single vetted authentication
mechanism that is known to be secure, can be extended to include strong authentication,
and has sufficient logging and monitoring to detect account abuse or breaches.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier que toutes les m\xE9thodes d'authentification\
\ et les API de gestion de l'identit\xE9 mettent en \u0153uvre un contr\xF4\
le de s\xE9curit\xE9 de l'authentification coh\xE9rent, de sorte qu'il\
\ n'y ait pas d'alternatives plus faibles par rapport au risque de l'application."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.2.4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.2
ref_id: V1.2.4
description: Verify that all authentication pathways and identity management
APIs implement consistent authentication security control strength, such that
there are no weaker alternatives per the risk of the application.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que toutes les voies d'authentification et les\
\ API de gestion des identit\xE9s impl\xE9mentent une force de contr\xF4\
le de s\xE9curit\xE9 d'authentification coh\xE9rente, de sorte qu'il n'y\
\ ait pas d'alternative plus faible en fonction du risque de l'application."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.4
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1
ref_id: V1.4
name: Access Control Architecture
translations:
fr:
name: "Exigences architecturales en mati\xE8re de contr\xF4le d'acc\xE8s"
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.4.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.4
ref_id: V1.4.1
description: Verify that trusted enforcement points, such as access control
gateways, servers, and serverless functions, enforce access controls. Never
enforce access controls on the client.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que des points d'application de confiance tels\
\ que les passerelles de contr\xF4le d'acc\xE8s, les serveurs et les fonctions\
\ sans serveur font respecter les contr\xF4les d'acc\xE8s. N'imposez jamais\
\ de contr\xF4les d'acc\xE8s au client."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.4.4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.4
ref_id: V1.4.4
description: Verify the application uses a single and well-vetted access control
mechanism for accessing protected data and resources. All requests must pass
through this single mechanism to avoid copy and paste or insecure alternative
paths. ([C7](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que l'application utilise un m\xE9canisme de contr\xF4\
le d'acc\xE8s unique et bien contr\xF4l\xE9 pour acc\xE9der aux donn\xE9\
es et ressources prot\xE9g\xE9es. Toutes les requ\xEAtes doivent passer\
\ par ce m\xE9canisme unique pour \xE9viter les copier-coller ou les chemins\
\ alternatifs non s\xE9curis\xE9s. ([C7](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.4.5
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.4
ref_id: V1.4.5
description: Verify that attribute or feature-based access control is used whereby
the code checks the user's authorization for a feature/data item rather than
just their role. Permissions should still be allocated using roles. ([C7](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que le contr\xF4le d'acc\xE8s bas\xE9 sur les\
\ attributs ou les caract\xE9ristiques est utilis\xE9, c'est-\xE0-dire\
\ que le code v\xE9rifie l'autorisation de l'utilisateur pour une caract\xE9\
ristique ou une donn\xE9e plut\xF4t que son seul r\xF4le. Les autorisations\
\ doivent tout de m\xEAme \xEAtre attribu\xE9es \xE0 l'aide de r\xF4les.\
\ ([C7](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.5
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1
ref_id: V1.5
name: Input and Output Architecture
translations:
fr:
name: "Exigences architecturales d'entr\xE9e et de sortie"
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.5.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.5
ref_id: V1.5.1
description: Verify that input and output requirements clearly define how to
handle and process data based on type, content, and applicable laws, regulations,
and other policy compliance.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier que les exigences en mati\xE8re d'entr\xE9e et\
\ de sortie d\xE9finissent clairement la mani\xE8re de traiter et d'exploiter\
\ les donn\xE9es en fonction du type, du contenu et de la conformit\xE9\
\ aux lois, r\xE8glements et autres politiques applicables. "
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.5.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.5
ref_id: V1.5.2
description: Verify that serialization is not used when communicating with untrusted
clients. If this is not possible, ensure that adequate integrity controls
(and possibly encryption if sensitive data is sent) are enforced to prevent
deserialization attacks including object injection.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que la s\xE9rialisation n'est pas utilis\xE9e\
\ lorsque vous communiquez avec des clients non fiables. Si cela n'est\
\ pas possible, assurez-vous que des contr\xF4les d'int\xE9grit\xE9 ad\xE9\
quats (et \xE9ventuellement un chiffrement si des donn\xE9es sensibles\
\ sont envoy\xE9es) sont appliqu\xE9s pour emp\xEAcher les attaques de\
\ d\xE9s\xE9rialisation, y compris l'injection d'objets."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.5.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.5
ref_id: V1.5.3
description: Verify that input validation is enforced on a trusted service layer.
([C5](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que la validation des entr\xE9es est appliqu\xE9\
e sur une couche de service de confiance. ([C5](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.5.4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.5
ref_id: V1.5.4
description: Verify that output encoding occurs close to or by the interpreter
for which it is intended. ([C4](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que l'encodage de sortie se fait \xE0 proximit\xE9\
\ ou par l'interpr\xE8te auquel il est destin\xE9. ([C4](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.6
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1
ref_id: V1.6
name: Cryptographic Architecture
translations:
fr:
name: "Exigences en mati\xE8re d'architecture cryptographique"
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.6.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.6
ref_id: V1.6.1
description: Verify that there is an explicit policy for management of cryptographic
keys and that a cryptographic key lifecycle follows a key management standard
such as NIST SP 800-57.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier qu'il existe une politique explicite de gestion\
\ des cl\xE9s cryptographiques et que le cycle de vie d'une cl\xE9 cryptographique\
\ suit une norme de gestion des cl\xE9s telle que NIST SP 800-57."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.6.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.6
ref_id: V1.6.2
description: Verify that consumers of cryptographic services protect key material
and other secrets by using key vaults or API based alternatives.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier que les consommateurs de services cryptographiques\
\ prot\xE8gent les cl\xE9s et autres secrets en utilisant des coffres-forts\
\ de cl\xE9s ou des alternatives bas\xE9es sur l'API."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.6.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.6
ref_id: V1.6.3
description: Verify that all keys and passwords are replaceable and are part
of a well-defined process to re-encrypt sensitive data.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que toutes les cl\xE9s et tous les mots de passe\
\ sont rempla\xE7ables et font partie d'un processus bien d\xE9fini de\
\ rechiffrement des donn\xE9es sensibles."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.6.4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.6
ref_id: V1.6.4
description: Verify that the architecture treats client-side secrets--such as
symmetric keys, passwords, or API tokens--as insecure and never uses them
to protect or access sensitive data.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que l'architecture traite les secrets c\xF4t\xE9\
\ client, tels que les cl\xE9s sym\xE9triques, les mots de passe ou les\
\ jetons d'API, comme non s\xE9curis\xE9s et ne les utilise jamais pour\
\ prot\xE9ger ou acc\xE9der \xE0 des donn\xE9es sensibles."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.7
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1
ref_id: V1.7
name: Errors, Logging and Auditing Architecture
translations:
fr:
name: "Erreurs, enregistrement et v\xE9rification des exigences architecturales"
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.7.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.7
ref_id: V1.7.1
description: Verify that a common logging format and approach is used across
the system. ([C9](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier qu'un format de journalisation communs soit utilis\xE9\
s dans le syst\xE8me. ([C9](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.7.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.7
ref_id: V1.7.2
description: Verify that logs are securely transmitted to a preferably remote
system for analysis, detection, alerting, and escalation. ([C9](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que les journaux sont transmis de mani\xE8re s\xE9\
curis\xE9e \xE0 un syst\xE8me de pr\xE9f\xE9rence distant pour analyse,\
\ d\xE9tection, alerte et escalade. ([C9](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.8
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1
ref_id: V1.8
name: Data Protection and Privacy Architecture
translations:
fr:
name: "Exigences architecturales en mati\xE8re de protection des donn\xE9\
es et de la vie priv\xE9e"
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.8.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.8
ref_id: V1.8.1
description: Verify that all sensitive data is identified and classified into
protection levels.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier que toutes les donn\xE9es sensibles sont identifi\xE9\
es et class\xE9es en niveaux de protection."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.8.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.8
ref_id: V1.8.2
description: Verify that all protection levels have an associated set of protection
requirements, such as encryption requirements, integrity requirements, retention,
privacy and other confidentiality requirements, and that these are applied
in the architecture.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier que tous les niveaux de protection sont associ\xE9\
s \xE0 un ensemble d'exigences de protection, telles que des exigences\
\ de chiffrement, d'int\xE9grit\xE9, de conservation, de respect de la\
\ vie priv\xE9e et d'autres exigences de confidentialit\xE9, et que celles-ci\
\ sont appliqu\xE9es dans l'architecture."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.9
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1
ref_id: V1.9
name: Communications Architecture
translations:
fr:
name: "Exigences en mati\xE8re d'architecture des communications"
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.9.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.9
ref_id: V1.9.1
description: Verify the application encrypts communications between components,
particularly when these components are in different containers, systems, sites,
or cloud providers. ([C3](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier que l'application chiffre les communications entre\
\ les composants, en particulier lorsque ces composants se trouvent dans\
\ des conteneurs, syst\xE8mes, sites ou fournisseurs de cloud diff\xE9\
rents. ([C3](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.9.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.9
ref_id: V1.9.2
description: Verify that application components verify the authenticity of each
side in a communication link to prevent person-in-the-middle attacks. For
example, application components should validate TLS certificates and chains.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier que les composants de l'application v\xE9rifient\
\ l'authenticit\xE9 de chaque partie d'un lien de communication afin de\
\ pr\xE9venir les attaques de type \"man-in-the-middle\". Par exemple,\
\ les composants d'application doivent valider les certificats et les\
\ cha\xEEnes TLS."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.10
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1
ref_id: V1.10
name: Malicious Software Architecture
translations:
fr:
name: "Exigences en mati\xE8re d'architecture des logiciels malveillants"
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.10.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.10
ref_id: V1.10.1
description: Verify that a source code control system is in use, with procedures
to ensure that check-ins are accompanied by issues or change tickets. The
source code control system should have access control and identifiable users
to allow traceability of any changes.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier qu'un syst\xE8me de contr\xF4le du code source\
\ est utilis\xE9, avec des proc\xE9dures pour s'assurer que les enregistrements\
\ sont accompagn\xE9s de tickets d'\xE9mission ou de modification. Le\
\ syst\xE8me de contr\xF4le du code source doit disposer d'un contr\xF4\
le d'acc\xE8s et d'utilisateurs identifiables pour permettre la tra\xE7\
abilit\xE9 de toute modification."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.11
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1
ref_id: V1.11
name: Business Logic Architecture
translations:
fr:
name: "Exigences en mati\xE8re d'architecture de la logique d'entreprise"
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.11.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.11
ref_id: V1.11.1
description: Verify the definition and documentation of all application components
in terms of the business or security functions they provide.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier la d\xE9finition et la documentation de tous les\
\ composants de l'application en ce qui concerne la logique m\xE9tier\
\ ou de s\xE9curit\xE9 qu'ils fournissent."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.11.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.11
ref_id: V1.11.2
description: Verify that all high-value business logic flows, including authentication,
session management and access control, do not share unsynchronized state.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que tous les flux de logique m\xE9tier de grande\
\ valeur, y compris l'authentification, la gestion de session et le contr\xF4\
le d'acc\xE8s, ne partagent pas un \xE9tat non synchronis\xE9."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.11.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.11
ref_id: V1.11.3
description: Verify that all high-value business logic flows, including authentication,
session management and access control are thread safe and resistant to time-of-check
and time-of-use race conditions.
implementation_groups:
- L3
translations:
fr:
name: null
description: "V\xE9rifier que tous les flux de logique m\xE9tier de grande\
\ valeur, y compris l'authentification, la gestion de session et le contr\xF4\
le d'acc\xE8s, sont s\xE9curis\xE9s et r\xE9sistants aux conditions de\
\ concurrence (\"race condition\") au temps de contr\xF4le et au temps\
\ d'utilisation."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.12
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1
ref_id: V1.12
name: Secure File Upload Architecture
translations:
fr:
name: "T\xE9l\xE9chargement de fichiers s\xE9curis\xE9s Exigences architecturales"
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.12.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.12
ref_id: V1.12.2
description: Verify that user-uploaded files - if required to be displayed or
downloaded from the application - are served by either octet stream downloads,
or from an unrelated domain, such as a cloud file storage bucket. Implement
a suitable Content Security Policy (CSP) to reduce the risk from XSS vectors
or other attacks from the uploaded file.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que les fichiers envoy\xE9s par l'utilisateur\
\ - s'ils doivent \xEAtre affich\xE9s ou t\xE9l\xE9charg\xE9s \xE0 partir\
\ de l'application - sont servis par des t\xE9l\xE9chargements en flux\
\ d'octets, ou \xE0 partir d'un domaine sans rapport, comme un compartiment\
\ de stockage de fichiers en nuage. Mettre en \u0153uvre une politique\
\ de s\xE9curit\xE9 du contenu (CSP) appropri\xE9e pour r\xE9duire le\
\ risque de vecteurs XSS ou d'autres attaques provenant du fichier t\xE9\
l\xE9charg\xE9."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.14
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1
ref_id: V1.14
name: Configuration Architecture
translations:
fr:
name: Configuration des exigences architecturales
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.14.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.14
ref_id: V1.14.1
description: Verify the segregation of components of differing trust levels
through well-defined security controls, firewall rules, API gateways, reverse
proxies, cloud-based security groups, or similar mechanisms.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez la s\xE9paration des composants de diff\xE9rents\
\ niveaux de confiance via des contr\xF4les de s\xE9curit\xE9 bien d\xE9\
finis, des r\xE8gles de pare-feu, des passerelles API, des proxys inverses,\
\ des groupes de s\xE9curit\xE9 bas\xE9s sur le cloud ou des m\xE9canismes\
\ similaires."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.14.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.14
ref_id: V1.14.2
description: Verify that binary signatures, trusted connections, and verified
endpoints are used to deploy binaries to remote devices.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier que les signatures binaires, les connexions de\
\ confiance et les n\u0153uds v\xE9rifi\xE9s sont utilis\xE9s pour d\xE9\
ployer des binaires sur des dispositifs distants."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.14.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.14
ref_id: V1.14.3
description: Verify that the build pipeline warns of out-of-date or insecure
components and takes appropriate actions.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier que le pipeline de construction signale les composants\
\ obsol\xE8tes ou peu s\xFBrs et prend les mesures appropri\xE9es."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.14.4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.14
ref_id: V1.14.4
description: Verify that the build pipeline contains a build step to automatically
build and verify the secure deployment of the application, particularly if
the application infrastructure is software defined, such as cloud environment
build scripts.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que le pipeline de construction contient une \xE9\
tape de g\xE9n\xE9ration pour g\xE9n\xE9rer automatiquement et v\xE9rifier\
\ le d\xE9ploiement s\xE9curis\xE9 de l'application, en particulier si\
\ l'infrastructure de l'application est d\xE9finie par logiciel, comme\
\ les scripts de g\xE9n\xE9ration d'environnement cloud."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.14.5
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.14
ref_id: V1.14.5
description: Verify that application deployments adequately sandbox, containerize
and/or isolate at the network level to delay and deter attackers from attacking
other applications, especially when they are performing sensitive or dangerous
actions such as deserialization. ([C5](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que les d\xE9ploiements d'applications sont correctement\
\ mis en bac \xE0 sable, conteneuris\xE9s et/ou isol\xE9s au niveau du\
\ r\xE9seau pour retarder et dissuader les attaquants d'attaquer d'autres\
\ applications, en particulier lorsqu'ils effectuent des actions sensibles\
\ ou dangereuses telles que la d\xE9s\xE9rialisation. ([C5](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.14.6
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v1.14
ref_id: V1.14.6
description: Verify the application does not use unsupported, insecure, or deprecated
client-side technologies such as NSAPI plugins, Flash, Shockwave, ActiveX,
Silverlight, NACL, or client-side Java applets.
implementation_groups:
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier que l'application n'utilise pas de technologies\
\ c\xF4t\xE9 client non prises en charge, non s\xE9curis\xE9es ou obsol\xE8\
tes telles que les plug-ins NSAPI, Flash, Shockwave, ActiveX, Silverlight,\
\ NACL ou des applets Java c\xF4t\xE9 client."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2
assessable: false
depth: 1
ref_id: V2
name: Authentication
translations:
fr:
name: Authentification
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2
ref_id: V2.1
name: Password Security
translations:
fr:
name: "Exigences en mati\xE8re de s\xE9curit\xE9 des mots de passe"
description: null
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1
ref_id: V2.1.1
description: Verify that user set passwords are at least 12 characters in length
(after multiple spaces are combined). ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L1
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que les mots de passe d\xE9finis par l'utilisateur\
\ comportent au moins 12 caract\xE8res (apr\xE8s avoir combin\xE9 plusieurs\
\ espaces). ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1
ref_id: V2.1.2
description: Verify that passwords of at least 64 characters are permitted,
and that passwords of more than 128 characters are denied. ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L1
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que les mots de passe de 64 caract\xE8res ou plus\
\ sont autoris\xE9s, mais pas au del\xE0 de 128 caract\xE8res. ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1
ref_id: V2.1.3
description: Verify that password truncation is not performed. However, consecutive
multiple spaces may be replaced by a single space. ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L1
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que le mot de passe n'est pas tronqu\xE9. Toutefois,\
\ des espaces multiples cons\xE9cutifs peuvent \xEAtre remplac\xE9s par\
\ un seul espace. ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))"
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1.4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1
ref_id: V2.1.4
description: Verify that any printable Unicode character, including language
neutral characters such as spaces and Emojis are permitted in passwords.
implementation_groups:
- L1
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que tout caract\xE8re Unicode imprimable, y compris\
\ les caract\xE8res neutres comme les espaces et les Emojis, sont autoris\xE9\
s dans les mots de passe."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1.5
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1
ref_id: V2.1.5
description: Verify users can change their password.
implementation_groups:
- L1
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifier que les utilisateurs peuvent changer leur mot\
\ de passe."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1.6
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1
ref_id: V2.1.6
description: Verify that password change functionality requires the user's current
and new password.
implementation_groups:
- L1
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que la fonctionnalit\xE9 de changement de mot\
\ de passe n\xE9cessite le mot de passe actuel et le nouveau mot de passe\
\ de l'utilisateur."
- urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1.7
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:owasp-asvs-4.0.3:v2.1
ref_id: V2.1.7
description: Verify that passwords submitted during account registration, login,
and password change are checked against a set of breached passwords either
locally (such as the top 1,000 or 10,000 most common passwords which match
the system's password policy) or using an external API. If using an API a
zero knowledge proof or other mechanism should be used to ensure that the
plain text password is not sent or used in verifying the breach status of
the password. If the password is breached, the application must require the
user to set a new non-breached password. ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))
implementation_groups:
- L1
- L2
- L3
translations:
fr:
name: null
description: "V\xE9rifiez que les mots de passe soumis lors de l'enregistrement\
\ du compte, de la connexion et du changement de mot de passe sont compar\xE9\