Cryptographic Inventory and Documentation
V11.1.1
Verify that there is a documented policy for management of cryptographic keys and a cryptographic key lifecycle that follows a key management standard such as NIST SP 800-57. This should include ensuring that keys are not overshared (for example, with more than two entities for shared secrets and more than one entity for private keys).
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 155, 204, 37, 473, 474, 548, 57, 639
V11.1.2
Verify that a cryptographic inventory is performed, maintained, regularly updated, and includes all cryptographic keys, algorithms, and certificates used by the application. It must also document where keys can and cannot be used in the system, and the types of data that can and cannot be protected using the keys.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 155, 204, 37, 473, 474, 548, 57, 639
V11.1.3
Verify that cryptographic discovery mechanisms are employed to identify all instances of cryptography in the system, including encryption, hashing, and signing operations.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 155, 204, 37, 473, 474, 548, 57, 639
V11.1.4
Verify that a cryptographic inventory is maintained. This must include a documented plan that outlines the migration path to new cryptographic standards, such as post-quantum cryptography, in order to react to future threats.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 155, 204, 37, 474, 548, 57, 639
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
