"can be used to establish a level of confidence in the security of Web applications."
ASVS is a great idea, eventhough my efforts to introduce it have been 100% unsuccessful. Any takers?
The standard defines four verification levels ranging from 1 to 4. Broadly speaking you can verify the security of your applications based on a specific level. For the least critical applications you might verify to level 1 - which is basically an automated scan. If it passes the scan, then the application is secure enough.
For the most critical applications you could verify to level 4. This includes manual testing, code reviews of all code (including external libraries).
Level 0 - No Verification
I think that there is an implied 5th level which is "Level 0 - No Verification". Basically we have no level of confidence in the security. Most current applications probably fall into this level. The applications have not been subject to any security verification. This does not mean that they are not secure. But since they have not been verified, we can have no confidence in the security so they fall into our imaginary ASVS Level 0.
This begs the question, should ASVS formally include "Level 0 - No Verification"? Probably not. No point really! Developers could claim that their applications have been verified to Level 0 - which defeats the purpose.
Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot
