Cyver core supports the OWASP Mobile Application Security Verification Standard (MASVS) Checklist, including:
- Version 1.2 (Levels 1, 2, and 3) for both Android and iOS platforms.
- Version 2.1.
The OWASP MASVS is recognized as the industry standard for mobile application security.
General Information on the OWASP MASVS
The OWASP MASVS (Mobile Application Security Verification Standard) provides a comprehensive set of security requirements that can be used by various stakeholders in the mobile development lifecycle.
What is the MASVS?
The MASVS is designed to be used by:
- Mobile Software Architects and Developers: To guide the development process and ensure applications are built securely from the ground up.
- Security Testers: To guarantee the completeness and consistency of security test results when verifying mobile application security.
MASVS Control Groups
The standard organizes its security requirements into various control groups, labeled MASVS-XXXXX, each representing a critical area of the mobile attack surface:
| Control Group | Focus Area |
|---|---|
| MASVS-STORAGE | Secure storage of sensitive data on the device (data-at-rest). |
| MASVS-CRYPTO | Cryptographic functionality used to protect sensitive data. |
| MASVS-AUTH | Authentication and authorization mechanisms used by the mobile app. |
| MASVS-NETWORK | Secure network communication between the mobile app and remote endpoints (data-in-transit). |
| MASVS-PLATFORM | Secure interaction with the underlying mobile platform and other installed apps. |
| MASVS-CODE | Security best practices for data processing and keeping the application up-to-date. |
| MASVS-RESILIENCE | The application's resilience to attempts at reverse engineering and tampering. |
| MASVS-PRIVACY | Privacy controls implemented to protect user privacy. |
Download
You can directly download the latest OWASP MASVS Checklist from our GitHub repository: