OWASP Application Security Verification Standard Implementation Training Course

Course overview

Application teams often have security requirements scattered across user stories, penetration-test findings, supplier questionnaires and policy documents. This makes it difficult to decide what “secure enough” means for a particular application, to build consistent acceptance criteria, or to demonstrate due diligence to customers, auditors and risk owners. The OWASP Application Security Verification Standard (ASVS) provides a structured basis for defining, implementing and verifying application security controls at the right assurance level.

This five-day course teaches participants how to use OWASP ASVS to establish security requirements, select an appropriate verification level, map controls to architecture and development practices, and plan evidence-based testing. Participants work through requirements covering authentication, session management, access control, input validation, cryptography, error handling, logging, secure configuration and API security. They learn to turn ASVS requirements into actionable backlog items, test cases, verification checklists, remediation priorities and traceability records.

Delivery combines instructor-led explanation with guided analysis of a deliberately vulnerable web application, hands-on testing using OWASP ZAP and Burp Suite, and team workshops using real ASVS control families. Participants finish with an ASVS implementation pack for a representative application: a scoped verification-level decision, requirements traceability matrix, prioritised control gap register, sample security test cases and a 90-day adoption plan. This gives attendees a practical artefact they can adapt for their own secure development lifecycle.

The course is designed for professionals who already work with application delivery, software assurance, penetration testing or security governance and need a repeatable method for embedding measurable application security requirements into development and assurance work.

Course objectives

By the end of this course, participants will be able to:

• Select an OWASP ASVS verification level using application risk, data sensitivity and exposure criteria
• Translate ASVS control requirements into security user stories, acceptance criteria and developer tasks
• Build an ASVS requirements traceability matrix linking controls to architecture components, tests and evidence
• Assess authentication, session management and access-control implementations against relevant ASVS requirements
• Create manual and automated verification test cases for input validation, API security and error-handling controls
• Use OWASP ZAP and Burp Suite to gather verification evidence for common web application security controls
• Prioritise ASVS control gaps through risk-based remediation planning and ownership assignment
• Produce an application-specific ASVS implementation pack and 90-day adoption roadmap

Benefits of attending

Target competencies

Who should attend

• Application Security Engineers — who need a consistent control catalogue for design reviews and verification
• Software Development Leads — who must convert security expectations into implementable team requirements
• Penetration Testers — who want to structure testing and reporting against recognised ASVS controls
• Security Architects — who define application assurance patterns across portfolios and delivery teams
• QA and Test Automation Leads — who need repeatable security acceptance criteria and test evidence
• GRC and Technology Risk Managers — who must evidence proportionate application security assurance

Requirements and prerequisites

Participants should understand how web applications and APIs are built and deployed, including HTTP requests and responses, authentication, authorisation, cookies, JSON and common development lifecycle stages. Experience reading user stories, test cases, vulnerability reports or architecture diagrams is expected. Participants should be comfortable using a browser, browser developer tools and basic command-line instructions; prior exposure to OWASP Top 10, Burp Suite or OWASP ZAP is helpful but not essential. This is not a programming course, and no prior penetration-testing certification, secure-code review experience or advanced exploit-development knowledge is required.

Training methodology

The instructor introduces each ASVS control family through annotated application scenarios, then participants apply the requirements in small teams. Workshops use architecture diagrams, user stories, HTTP traffic, test evidence and sample vulnerability findings from a web application and API. Hands-on labs use OWASP ZAP and Burp Suite to validate selected controls and distinguish a finding from evidence of compliance. Daily review sessions connect test results to ASVS requirements. On day five, each participant assembles an implementation pack and adoption plan for use in their own delivery environment.

Course outline

Day 1: ASVS foundations and assurance scoping

• Purpose, structure and control numbering of OWASP ASVS
• Verification Levels 1, 2 and 3 selection criteria
• Application risk profiling for ASVS scope decisions
• Mapping business assets and data classifications to security requirements
• ASVS use in secure SDLC gates and procurement requirements
• Reading ASVS control language, objectives and verification requirements
• Building an application security requirements traceability matrix

Workshop: Participants scope a representative application, choose an ASVS verification level and produce an initial control-selection rationale.

Day 2: Identity, access and sensitive-data controls

• Authentication architecture and credential lifecycle requirements
• Multi-factor authentication and account recovery verification
• Session management, cookie attributes and token handling
• Authorisation models and server-side access-control testing
• Object-level and function-level authorisation for APIs
• Cryptographic protection of data at rest and in transit
• Secrets management and sensitive-data exposure controls

Workshop: Participants inspect authentication and API request flows, then produce ASVS-aligned test cases and evidence requirements for identity and access controls.

Day 3: Input handling, API assurance and secure configuration

• Input validation and canonicalisation verification methods
• Output encoding and cross-site scripting prevention controls
• SQL injection, command injection and deserialisation test design
• API schema validation, rate limiting and endpoint protection
• File upload security and content-validation requirements
• Error handling, logging and security-event monitoring controls
• Secure configuration, dependency and deployment verification

Workshop: Using OWASP ZAP and Burp Suite, participants test selected web and API controls and record reproducible ASVS verification evidence.

Day 4: Evidence, testing and remediation management

• Designing ASVS verification procedures and pass-fail criteria
• Manual testing versus automated security testing evidence
• Using OWASP ZAP scan results within an ASVS verification process
• Burp Suite request manipulation for control validation
• Documenting evidence, exceptions and compensating controls
• Risk-based gap analysis and remediation prioritisation
• Reporting ASVS coverage to engineering leaders and risk owners

Workshop: Participants convert lab findings and supplied evidence into a control gap register with severity, owner, target date and retest criteria.

Day 5: Operationalising ASVS in the delivery lifecycle

• Integrating ASVS requirements into epics, stories and definition of done
• ASVS checkpoints for architecture review and threat modelling
• Security test planning across build, release and production stages
• Supplier assurance and contract requirements using ASVS
• Metrics for control coverage, remediation ageing and verification status
• Tailoring ASVS templates for application portfolios
• Ninety-day rollout planning and stakeholder ownership

Workshop: Participants complete an ASVS implementation pack containing a traceability matrix, prioritised gap register, sample tests and 90-day adoption roadmap.

Tools & standards covered

OWASP Application Security Verification Standard (ASVS), OWASP ZAP, Burp Suite, OWASP Threat Dragon

A typical training day

Live online deliveries follow the same structure in the East Africa Time zone, with shorter screen blocks and longer breaks.

What the fee includes

How you can take this course

Certification

Participants who complete the full five days receive the Skillset Development Certificate of Completion, stating the course title, course code, dates and delivery format — suitable for professional-development records and employer reimbursement.

Frequently asked questions