Write code that meets the OWASP ASVS 5.0 standard. This two-day intermediate course walks through the key ASVS chapters with hands-on implementation: encoding, validation, authentication, sessions, authorization, cryptography, configuration and data protection. Includes the ASVS Secure Coder Prompt Pack for AI-assisted development.
Every module maps directly to an ASVS chapter. You will implement the requirements, not just read them. Includes use of the ASVS Secure Coder Prompt Pack with Claude and GPT. (Times are approximate.)
Understand how the ASVS is organized: chapters, sections, verification requirements, and the three levels (L1, L2, L3). Learn how to read a requirement, how to determine your target level, and how to use the ASVS as a development standard rather than just an audit checklist.
The Prompt Pack turns ASVS requirements into actionable coding prompts for AI assistants. Walk through how to feed a requirement to Claude or GPT and get back code that meets the requirement. Practice with real requirements across multiple chapters.
Deep dive into ASVS Chapter 1 on encoding, escaping and sanitization. Cover every context (HTML, JS, CSS, URL, SQL, LDAP, XML, OS command). Implement encoding libraries, test for bypass techniques, and verify your output against the ASVS requirements.
ASVS Chapter 2 covers input validation and business logic verification. Implement server-side validation that cannot be bypassed by disabling JavaScript. Cover type coercion attacks, mass assignment, and business logic flaws where valid inputs produce invalid state transitions.
Implement ASVS Chapter 6 authentication requirements. Hash passwords with Argon2id (preferred) and bcrypt. Integrate HIBP (Have I Been Pwned) breach checking at registration and password change. Implement multi-factor authentication and account lockout without enabling denial of service.
Implement ASVS Chapter 7 session management requirements. Generate cryptographically random session IDs, bind sessions to the client, enforce idle and absolute timeouts, invalidate sessions on logout and password change. Cover session fixation and how to prevent it.
Implement ASVS Chapter 8 access control requirements. Build role-based access control (RBAC) and attribute-based access control (ABAC) patterns. Test for vertical and horizontal privilege escalation. Implement the deny-by-default principle and verify every request is authorized.
Implement ASVS Chapter 11 cryptographic requirements. Use AES-256-GCM for symmetric encryption, ECDSA or Ed25519 for signing, and proper key derivation. Avoid deprecated algorithms (DES, 3DES, RC4, MD5, SHA-1 for signing). Handle key storage, rotation, and lifecycle management.
Implement ASVS Chapter 13 configuration requirements. Separate secrets from code. Use environment variables or secret managers. Harden default configurations. Disable debug endpoints, directory listings, and verbose error pages in production. Verify with automated checks.
Implement ASVS Chapter 14 data protection requirements. Classify data by sensitivity. Apply encryption at rest and in transit. Implement data minimization and retention policies. Handle PII correctly. Cover the right-to-erasure requirements and how to implement them technically.
Implement ASVS Chapter 16 logging requirements. Log authentication events, authorization failures, input validation failures, and security-relevant business events. Never log secrets or full PII. Structure logs for SIEM ingestion. Implement tamper-evident logging.
Bring a real or representative application and assess it against the ASVS at your target level. Use the Prompt Pack to generate verification tests. Document gaps, prioritize by risk, and create a remediation plan. This is the exercise that turns the ASVS from a document into a working process.
Given an application with known ASVS gaps across multiple chapters, verify each requirement, document the finding, and implement the fix. Score against the ASVS at L1. This lab validates that you can use the ASVS as a working development standard.
Review the ASVS checklist mapped to the modules covered. Discuss how to integrate ASVS verification into sprints and CI/CD pipelines. Take-home resources and next steps.
Two days of hands-on development mapped to the OWASP ASVS 5.0. Implement the requirements across authentication, sessions, authorization, cryptography and data protection. Taught by the former OWASP-AISVS Co-Leader.
Corporate and sovereign cohorts, and bespoke on-site delivery, on request.