OWASP MASVS

Per OWASP MASVS v2 MASVS-AUTH: secure authentication and authorization in mobile apps. Requirements include (a) implement strong server-side authentication aligned to standards (OAuth 2.0 + OIDC + FIDO2/WebAuthn + biometric where appropriate) + (b) require multi-factor authentication for sensitive operations + (c) protect session tokens against theft + replay + with secure storage + handling + (d) implement client-side authorisation as defense in depth (do not rely on client for authorisation enforcement) + (e) implement biometric authentication using platform APIs with proper fallback + (f) implement secure credential lifecycle (storage + reset + revocation) + (g) implement step-up authentication for sensitive operations.

• MASVS v2 group 3 evidence

• MASTG test coverage incomplete + privacy controls partial

Per OWASP MASVS v2 MASVS-CODE: code quality + build settings + secure updates. Requirements include (a) implement secure coding practices including input validation + output encoding + memory safety + (b) use memory-safe languages + APIs where possible + (c) implement secure build settings including code signing + debug flag removal + symbol stripping + obfuscation where appropriate + (d) maintain dependency inventory + scan for vulnerabilities + license issues + malicious packages + (e) implement secure update mechanism including signature verification + rollback prevention + (f) protect against client-side injection (XSS in WebView + SQL in local DB + similar) + (g) integrate static + dynamic + interactive application security testing + maintain test coverage.

• MASVS v2 group 6 evidence

• MASTG test coverage incomplete + privacy controls partial

Per OWASP MASVS v2 MASVS-CRYPTO: correct use of cryptography in mobile apps. Requirements include (a) use industry-vetted cryptographic primitives + libraries + parameter choices appropriate to risk + (b) avoid weak + deprecated algorithms + custom cryptography + (c) use platform-provided cryptographic APIs over rolling own + (d) implement secure key management using hardware-backed key storage (Android Keystore + iOS Secure Enclave) where available + (e) maintain key lifecycle including generation + rotation + revocation + destruction + (f) maintain crypto-agility for migration when algorithms or parameters become broken + (g) protect cryptographic material in memory and during processing.

• MASVS v2 group 2 evidence

• MASTG test coverage incomplete + privacy controls partial

Per OWASP MASVS v2 MASVS-NETWORK: secure network communication for mobile apps. Requirements include (a) use TLS 1.2 or later with strong cipher suites for all sensitive network communications + (b) implement certificate pinning where appropriate + with secure pin management + rotation + (c) validate certificates properly + reject invalid + expired + untrusted certificates + (d) protect against TLS downgrade + man-in-the-middle attacks + (e) implement App Transport Security (iOS) + Network Security Config (Android) policies + (f) protect against insecure network configurations including HTTP fallback + cleartext + weak ciphers + (g) implement appropriate timeouts + retries + circuit breaker patterns.

• MASVS v2 group 4 evidence

• MASTG test coverage incomplete + privacy controls partial

Per OWASP MASVS v2 MASVS-PLATFORM: secure platform interaction. Requirements include (a) request only necessary permissions + provide clear justification + (b) implement secure inter-app communication (IPC) restricting receivers + intent filters + URL handlers + content providers + (c) implement WebView security including JavaScript bridge restrictions + URL allowlisting + same-origin policy + (d) implement deeplink + universal link validation against intent hijacking + (e) protect against tapjacking + overlay attacks + (f) implement screen capture protection for sensitive screens where appropriate + (g) protect against background snapshot exposure.

• MASVS v2 group 5 evidence

• MASTG test coverage incomplete + privacy controls partial

Per OWASP MASVS v2 MASVS-PRIVACY: protect privacy + personal data in mobile apps. Requirements include (a) implement data minimisation collecting only data necessary for the function + (b) provide clear + accessible privacy notices + consent mechanisms + (c) implement data subject rights (access + rectification + erasure + portability) per applicable regulation + (d) implement secure handling of third-party SDK data sharing including privacy review + contractual controls + (e) maintain logging + monitoring for privacy-sensitive operations + (f) implement appropriate permission justifications + just-in-time prompts + (g) align to applicable privacy regulation (GDPR + CCPA + APPI + LGPD + similar) including breach notification + cross-border transfer controls.

• MASVS v2 group 8 evidence

• MASTG test coverage incomplete + privacy controls partial

Per OWASP MASVS v2 MASVS-RESILIENCE: resilience against reverse engineering + tampering. Requirements include (a) understand resilience is defence in depth + not replacement for server-side controls + (b) implement anti-debugging + anti-tampering + anti-hooking + root/jailbreak detection appropriate to risk + (c) implement code + string + asset obfuscation where appropriate + (d) implement integrity checks for code + resources + (e) implement device binding + attestation for high-assurance scenarios + (f) maintain telemetry + detection for tampering attempts + (g) avoid hard-coded secrets + use server-side validation for sensitive logic + (h) maintain backup procedures resistant to ransomware + rollback.

• MASVS v2 group 7 evidence

• MASTG test coverage incomplete + privacy controls partial

Per OWASP MASVS v2 MASVS-STORAGE: secure storage of sensitive data on mobile devices. Requirements include (a) identify + classify sensitive data handled by the app (credentials + tokens + personal data + financial + health + behavioural data) + (b) use the platform-provided secure storage facilities (Android Keystore + iOS Keychain + secure enclaves) for sensitive data + (c) avoid storing sensitive data in shared storage + logs + screenshots + clipboard + keyboard cache + backups + (d) implement encryption at rest with keys protected by hardware-backed storage where available + (e) clear sensitive data from memory + UI + caches when no longer needed + (f) implement secure backup handling preventing sensitive data inclusion + (g) restrict permission justification for storage access.

• MASVS v2 group 1 evidence

• MASTG test coverage incomplete + privacy controls partial