OWASP MASVS

What it means

The OWASP Mobile Application Security Verification Standard, or MASVS, is a list of security requirements for iOS and Android apps. It is part of OWASP's Mobile Application Security project, which also publishes a testing guide (MASTG) that explains how to check each requirement.

Version 2 groups the requirements into areas: storage, cryptography, authentication, network communication, platform interaction, code quality, resilience and privacy. Each area has a few short control statements, such as that the app handles sensitive data securely on the device. The project also publishes a checklist you can fill in for each app.

Why it matters

It gives your team and your testers a common checklist, so a mobile pentest is measured against something written down. Buyers and regulators increasingly ask whether a mobile app has been assessed against a recognised standard, and MASVS is the usual answer.

It also keeps the scope sensible. Most serious mobile problems are not in the app screen. They sit in the backend the app calls. A mobile pentest against the standard should cover both the device-side controls and the API behind them.

How it shows up

Teams use it at design time to write requirements, at build time as a review list, and at test time as the basis of a report. The MASTG gives test cases, and the project also provides a checklist you can fill in per app.

Be realistic about the resilience group. Controls against reverse engineering and tampering raise the effort for an attacker, but they do not stop a determined one. Spend your first effort on storage, network and authentication, and make sure the server enforces access checks, because anyone can call your API without your app.