Sources
Entries from OWASP MASVS v2.1.0 release. “Guides here” counts the guides whose main subject is the entry or that cover it in a dedicated section.
OWASP MASVS 2.1.0 controls
The Mobile Application Security Verification Standard sets 24 high-level controls for mobile apps in eight groups; the OWASP Mobile Application Security Testing Guide (MASTG) holds the tests. Each control page gives OWASP’s statement, how to meet it on iOS and Android, the guides here and the MASTG tests the local iOS and Android projects run. Cite a control with its version, for example MASVS v2.1.0 MASVS-STORAGE-1.
MASTG tests counted here are those the local iOS and Android projects run. The tests OWASP maps to each control are on its page on mas.owasp.org.
MASVS-STORAGE: Storage
Sensitive data the app stores on the device on purpose, and data that leaks there as a side effect of APIs, backups or logs.
| Control | OWASP statement | Guides here | MASTG tests here |
|---|---|---|---|
| MASVS-STORAGE-1 Secure data storage | The app securely stores sensitive data. | 5 | 6 |
| MASVS-STORAGE-2 Preventing data leaks | The app prevents leakage of sensitive data. | 3 | 2 |
MASVS-CRYPTO: Cryptography
Cryptography that follows current external standards, and keys managed through their whole lifecycle, because a lost or stolen device puts an attacker next to the data.
| Control | OWASP statement | Guides here | MASTG tests here |
|---|---|---|---|
| MASVS-CRYPTO-1 Strong cryptography | The app employs current strong cryptography and uses it according to industry best practices. | 3 | — |
| MASVS-CRYPTO-2 Key management | The app performs key management according to industry best practices. | 2 | — |
MASVS-AUTH: Authentication and Authorization
Authentication and authorization protocols the app uses with its backend, which must enforce them, and local authentication such as biometrics or a PIN.
| Control | OWASP statement | Guides here | MASTG tests here |
|---|---|---|---|
| MASVS-AUTH-1 Authentication and authorization protocols | The app uses secure authentication and authorization protocols and follows the relevant best practices. | 3 | — |
| MASVS-AUTH-2 Local authentication | The app performs local authentication securely according to the platform best practices. | 2 | — |
| MASVS-AUTH-3 Step-up for sensitive operations | The app secures sensitive operations with additional authentication. | 3 | — |
MASVS-NETWORK: Network Communication
Encrypted, authenticated connections in every case, including where low-level APIs or libraries could bypass the platform defaults, and pinning for endpoints the developer controls.
| Control | OWASP statement | Guides here | MASTG tests here |
|---|---|---|---|
| MASVS-NETWORK-1 Secure network traffic | The app secures all network traffic according to the current best practices. | 4 | 3 |
| MASVS-NETWORK-2 Identity pinning | The app performs identity pinning for all remote endpoints under the developer's control. | 3 | — |
MASVS-PLATFORM: Platform Interaction
What the app exposes to other apps and the user through IPC mechanisms and WebViews, and what its user interface can leak.
| Control | OWASP statement | Guides here | MASTG tests here |
|---|---|---|---|
| MASVS-PLATFORM-1 Inter-process communication | The app uses IPC mechanisms securely. | 4 | 5 |
| MASVS-PLATFORM-2 WebViews | The app uses WebViews securely. | 2 | 1 |
| MASVS-PLATFORM-3 User interface | The app uses the user interface securely. | 4 | — |
MASVS-CODE: Code Quality
Current platform versions, a way to force updates, components without known vulnerabilities and validation of every untrusted input.
| Control | OWASP statement | Guides here | MASTG tests here |
|---|---|---|---|
| MASVS-CODE-1 Up-to-date platform | The app requires an up-to-date platform version. | 1 | — |
| MASVS-CODE-2 Enforced app updates | The app has a mechanism for enforcing app updates. | — | — |
| MASVS-CODE-3 Components without known vulnerabilities | The app only uses software components without known vulnerabilities. | — | — |
| MASVS-CODE-4 Untrusted input validation | The app validates and sanitizes all untrusted inputs. | 2 | 3 |
MASVS-RESILIENCE: Resilience Against Reverse Engineering and Tampering
Defense-in-depth that raises the cost of reverse engineering and tampering: platform integrity checks, anti-tampering, and anti-static and anti-dynamic analysis.
| Control | OWASP statement | Guides here | MASTG tests here |
|---|---|---|---|
| MASVS-RESILIENCE-1 Platform integrity | The app validates the integrity of the platform. | 5 | — |
| MASVS-RESILIENCE-2 Anti-tampering | The app implements anti-tampering mechanisms. | 2 | — |
| MASVS-RESILIENCE-3 Anti-static analysis | The app implements anti-static analysis mechanisms. | 1 | — |
| MASVS-RESILIENCE-4 Anti-dynamic analysis | The app implements anti-dynamic analysis techniques. | 1 | — |
MASVS-PRIVACY: Privacy
A baseline for user privacy that can be checked in the app itself: data minimization, unlinkability, transparency and user control.
| Control | OWASP statement | Guides here | MASTG tests here |
|---|---|---|---|
| MASVS-PRIVACY-1 Data minimization | The app minimizes access to sensitive data and resources. | 2 | — |
| MASVS-PRIVACY-2 Preventing user identification | The app prevents identification of the user. | 1 | — |
| MASVS-PRIVACY-3 Transparency | The app is transparent about data collection and usage. | 1 | — |
| MASVS-PRIVACY-4 User control over data | The app offers user control over their data. | 1 | — |