Secret Management
V13.3.1
Verify that a secrets management solution, such as a key vault, is used to securely create, store, control access to, and destroy backend secrets. These could include passwords, key material, integrations with databases and third-party systems, keys and seeds for time-based tokens, other internal secrets, and API keys. Secrets must not be included in application source code or included in build artifacts. For an L3 application, this must involve a hardware-backed solution such as an HSM.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 116, 155, 184, 188, 191, 204, 206, 207, 233, 37, 444, 445, 474, 511, 523, 548, 55, 554, 57, 639, 68
V13.3.2
Verify that access to secret assets adheres to the principle of least privilege.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 1, 122, 155, 176, 180, 184, 204, 206, 233, 37, 444, 445, 474, 511, 523, 548, 554, 57, 58, 639, 68
V13.3.3
Verify that all cryptographic operations are performed using an isolated security module (such as a vault or hardware security module) to securely manage and protect key material from exposure outside of the security module.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 155, 184, 204, 206, 233, 37, 444, 445, 474, 511, 523, 548, 554, 57, 639, 68
V13.3.4
Verify that secrets are configured to expire and be rotated based on the application's documentation.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 151, 180, 37, 445, 511, 554, 633
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
