Configuration Documentation
V13.1.1
Verify that all communication needs for the application are documented. This must include external services which the application relies upon and cases where an end user might be able to provide an external location to which the application will then connect.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 154, 176, 240, 481
V13.1.2
Verify that for each service the application uses, the documentation defines the maximum number of concurrent connections (e.g., connection pool limits) and how the application behaves when that limit is reached, including any fallback or recovery mechanisms, to prevent denial of service conditions.
Required for Level 3
Related CAPEC™ Requirements
V13.1.3
Verify that the application documentation defines resourcemanagement strategies for every external system or service it uses (e.g., databases, file handles, threads, HTTP connections). This should include resourcerelease procedures, timeout settings, failure handling, and where retry logic is implemented, specifying retry limits, delays, and backoff algorithms. For synchronous HTTP requestresponse operations it should mandate short timeouts and either disable retries or strictly limit retries to prevent cascading delays and resource exhaustion.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 125, 227, 603, 607
V13.1.4
Verify that the application's documentation defines the secrets that are critical for the security of the application and a schedule for rotating them, based on the organization's threat model and business requirements.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 155, 204, 37, 474, 548, 57, 639
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
