Security Events
V16.3.1
Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 114, 151, 156, 2, 206, 21, 268, 39, 49, 50, 600, 68, 70, 75
V16.3.2
Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 1, 11, 114, 116, 121, 122, 126, 133, 143, 144, 149, 151, 155, 156, 162, 166, 172, 176, 179, 180, 203, 206, 207, 21, 212, 22, 240, 268, 36, 39, 49, 50, 54, 58, 600, 68, 74, 75, 87, 95
V16.3.3
Verify that the application logs the security events that are defined in the documentation and also logs attempts to bypass the security controls, such as input validation, business logic, and anti-automation.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 1, 100, 105, 11, 112, 113, 114, 115, 116, 121, 122, 125, 126, 127, 130, 133, 136, 137, 140, 145, 151, 152, 153, 155, 156, 157, 160, 162, 165, 166, 172, 175, 176, 179, 180, 183, 184, 188, 19, 198, 2, 20, 201, 204, 206, 207, 21, 212, 216, 217, 218, 22, 220, 227, 23, 231, 233, 234, 24, 240, 242, 248, 25, 250, 253, 26, 261, 267, 268, 272, 28, 30, 33, 36, 37, 383, 39, 43, 441, 444, 461, 463, 469, 473, 474, 475, 48, 49, 50, 523, 54, 549, 554, 57, 572, 586, 594, 600, 603, 607, 620, 633, 636, 639, 64, 66, 664, 676, 68, 69, 70, 74, 75, 77, 83, 88, 93, 94, 95, 97
V16.3.4
Verify that the application logs unexpected errors and security control failures such as backend TLS failures.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 105, 114, 136, 145, 151, 156, 157, 159, 160, 169, 175, 176, 183, 184, 19, 201, 206, 21, 216, 217, 218, 220, 23, 24, 250, 253, 268, 272, 310, 33, 39, 438, 442, 445, 446, 461, 475, 49, 50, 511, 523, 538, 594, 600, 620, 633, 636, 66, 664, 673, 68, 690, 691, 83, 94
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
