OWASP MASVS
The OWASP Mobile Application Security Verification Standard is a framework that defines what a mobile application must satisfy to be considered secure, organised into control groups covering storage, cryptography, authentication, network, platform interaction, code quality and resilience.
MASVS states the requirement; the companion Mobile Application Security Testing Guide describes how to verify it. Together they are the common vocabulary between a testing vendor and an enterprise security team, which is why findings are expected to cite control identifiers rather than prose severity alone.
Verifying the resilience group in particular presumes a device the application is willing to run on — the requirements concern behaviour under attack, and an application that has withdrawn into a defensive mode is not exhibiting that behaviour.
Related terms
- OWASP MASTG — The OWASP Mobile Application Security Testing Guide is the companion manual to MASVS, describing concrete procedures for verifying each requirement on Android and iOS.
- Certificate pinning — Certificate pinning is a control in which an application accepts only a specific certificate or public key for a server, rather than any certificate signed by a trusted authority.
- False negative (security testing) — A false negative in security testing is a result that reports no issue when an issue is in fact present.