etc.) Verify that for each type of output encoding/escaping performed by the application, is a single security control for that type of output for the V5.19 intended destination. V7: Cryptography at Rest Verification Requirements The table below defines the corresponding verification requirements that apply for each of the verification levels. Verification requirements for Level 0 are not defined by this standard. CRYPTOGRAPHY AT REST LEVELS VERIFICATION REQUIREMENT 1 2 3 Verify that all cryptographic functions used to protect secrets from the V7.1 application user are implemented server side. Verify that all cryptographic modules fail securely. V7.2 Verify that access to any master secret(s) is protected from unauthorized access (A master secret is an application credential stored as plaintext on disk V7.3 that is used to protect access to security configuration information). Verify that all random numbers, random file names, random GUIDs, and random strings are generated using the cryptographic module’s approved V7.6 random number generator when these random values are intended to be unguessable by an attacker.
etc.) V5.19 Verify that for each type of output encoding/escaping performed by the application, is a single security control for that type of output for the intended destination. V7: Cryptography at Rest Verification Requirements The table below defines the corresponding verification requirements that apply for each of the verification levels. Verification requirements for Level 0 are not defined by this standard. CRYPTOGRAPHY AT REST VERIFICATION REQUIREMENT LEVELS 1 2 3 V7.1 Verify that all cryptographic functions used to protect secrets from the application user are implemented server side. V7.2 Verify that all cryptographic modules fail securely. V7.3 Verify that access to any master secret(s) is protected from unauthorized access (A master secret is an application credential stored as plaintext on disk that is used to protect access to security configuration information). V7.6 Verify that all random numbers, random file names, random GUIDs, and random strings are generated using the cryptographic module’s approved random number generator when these random values are intended to be unguessable by an attacker.
OWASP_ASVS_Version_2.docx