diff --git a/.github/workflows/build-website.yml b/.github/workflows/build-website.yml index 8133c568d6..f3dedcbf69 100644 --- a/.github/workflows/build-website.yml +++ b/.github/workflows/build-website.yml @@ -25,6 +25,8 @@ jobs: repository: "OWASP/owasp-masvs" fetch-depth: 1 path: owasp-masvs/ + - name: Populate MASVS Categories Markdown Files + run: python3 ./owasp-masvs/tools/populate_masvs_categories_md.py -w - run: ./tools/scripts/structure_masvs.sh - run: mkdir docs/assets/Images/MASVS - run: mv owasp-masvs/Document/images/* docs/assets/Images/MASVS diff --git a/docs/MASVS.md b/docs/MASVS.md index 4f7b6916be..2384e3a0bb 100644 --- a/docs/MASVS.md +++ b/docs/MASVS.md @@ -8,33 +8,12 @@ The **OWASP MASVS (Mobile Application Security Verification Standard)** is the i
-[:material-download: Download the MASVS v1.5.0](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-en.pdf){ .md-button .md-button--primary } +[:material-download: Download the MASVS v2.0.0](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS.pdf){ .md-button .md-button--primary }
-:new: The MASVS 2.0.0 is already available as a spreadsheet. We're currently working on updating this page and the related documents. Learn more about the refactoring process [here](https://github.com/OWASP/owasp-masvs/discussions/categories/big-masvs-refactoring). + :material-translate: Starting with MASVS v2.0.0, translations will no longer be included to focus on the development of MASTG v2.0.0. We encourage the community to create and maintain their own translations. Thank you to all the past translators who generously volunteered their time and expertise to make the MASVS accessible to non-English speaking communities. We truly appreciate your contributions and hope to continue working together in the future. The past MASVS v1 translations are still available in the MASVS repo. -[:material-open-in-new: MASVS v2.0.0](https://docs.google.com/spreadsheets/d/1MZIvJ5Aze-zpyzLvQZVwyzF0bKWRPfnEd7nqFeH2PfA/edit?usp=sharing){ .md-button } - -
- -> :material-translate: The OWASP MASVS v1.5.0 is also available in [other languages](https://github.com/OWASP/owasp-masvs#masvs-translations). Is your language not here? We'd love to [add it](contributing/4_Add_new_Language.md)! -> -> :material-download: Download international PDFs: -> -> [Deutsch](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-de.pdf) | -> [Español](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-es.pdf) | -> [François](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-fr.pdf) | -> [فارسى](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-fa.pdf) | -> [हिन्दी](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-hi.pdf) | -> [日本語](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-ja.pdf) | -> [한국어](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-ko.pdf) | -> [português (br)](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-ptbr.pdf) | -> [português (pt)](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-ptpt.pdf) | -> [Русский](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-ru.pdf) | -> [Türk](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-tr.pdf) | -> [Ελληνικά](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-gr.pdf) | -> [中文 (cn)](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-zhcn.pdf) | -> [中文 (tw)](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.5.0-zhtw.pdf) +[:material-open-in-new: MASVS v1.5.0](https://github.com/OWASP/owasp-masvs/releases/tag/v1.5.0){ .md-button }
diff --git a/docs/assets/masvs_cover.png b/docs/assets/masvs_cover.png index 6f20c775f5..0204640fca 100644 Binary files a/docs/assets/masvs_cover.png and b/docs/assets/masvs_cover.png differ diff --git a/docs/news.md b/docs/news.md index 9c147677a3..e00549beba 100644 --- a/docs/news.md +++ b/docs/news.md @@ -3,7 +3,50 @@ !!! tip "Tip: Follow us on Twitter!" Follow [:material-twitter: @OWASP_MAS](https://twitter.com/OWASP_MAS) to get the latest updates instantly. - + +## April 1st, 2023: MASVS v2.0.0 Release + + + +masvs_v2_release + +We are thrilled to announce the release of the new version of the [OWASP Mobile Application Security Verification Standard (MASVS) v2.0.0](https://github.com/OWASP/owasp-masvs/releases/tag/v2.0.0). With this update, we have set out to achieve several key objectives to ensure that MASVS remains a leading industry standard for mobile application security. + +- **Keep Abstraction**: we have worked hard to maintain the level of abstraction that has made MASVS so valuable in the past. We leave the details to the MASTG. +- **Simplify**: we have simplified the MASVS by removing redundancies and overlaps in the security controls. This will make it easier for users to understand the standard and implement it effectively in their own projects. +- **Bring Clarity**: we have worked hard to use standard terminology wherever possible, drawing on established sources such as NIST-SP 800-175B and NIST OSCAL, as well as well-known and used sources such as CWEs, Android Developer Docs, and Apple Docs. +- **Narrow Scope**: we have narrowed the scope of MASVS to rely more heavily on other industry standards such as the OWASP ASVS, OWASP SAMM and NIST.SP.800-218 SSDF v1.1. This will ensure that MASVS remains relevant and up-to-date in a rapidly evolving landscape of mobile application security. + +We believe that these changes will make the OWASP MASVS v2.0.0 an even more valuable resource for developers and security practitioners alike, and we are excited to see how the industry embraces these updates. + +The MASVS v2.0.0 was presented at the OWASP AppSec Dublin 2023, you can watch the presentation [ ▶️ here](https://www.youtube.com/watch?v=GxcabVcCEiQ). + +### Why are there no levels in the new MASVS controls? + +The Levels you already know (L1, L2 and R) will be fully reviewed and backed up with a corrected and well-documented threat model. + +**Enter MAS Profiles:** We are moving the levels to the MASTG tests so that we can evaluate different situations for the same control (e.g., in MASVS-STORAGE-1, it's OK to store data unencrypted in app internal storage for L1, but L2 requires data encryption). This can lead to different tests depending on the security profile of the application. + +### Transition Phase + +The MASTG, in its current version v1.5.0, currently still supports the MASVS v1.5.0. Bringing the MASTG to v2.0.0 to be fully compatible with MASVS v2.0.0 will take some time. That's why we need to introduce a "transition phase". We're currently mapping all new proposed test cases to the new profiles (at least L1 and L2), so even if the MASTG refactoring is not complete, you'll know what to test for, and you'll be able to find most of the tests already in the MASTG. + +- Map the current MASTG tests to the new MASVS v2.0.0. +- Assign profiles to the proposed MASTG atomic tests (at least L1, L2 and R). + +### Special Thanks + +We thank everyone that has participated in the MASVS Refactoring. You can access all Discussion and documents for the refactoring [here](https://github.com/OWASP/owasp-masvs/discussions/categories/big-masvs-refactoring). + +You'll notice that we have one **new author in the MASVS: Jeroen Beckers** + +> Jeroen is a mobile security lead responsible for quality assurance on mobile security projects and for R&D on all things mobile. Ever since his master's thesis on Android security, Jeroen has been interested in mobile devices and their (in)security. He loves sharing his knowledge with other people, as is demonstrated by his many talks & trainings at colleges, universities, clients and conferences. + +💙 Special thanks to our [MAS Advocate](https://mas.owasp.org/MASTG/Intro/0x02c-Acknowledgements/#mas-advocates), [NowSecure](https://www.nowsecure.com/), who has once again demonstrated their commitment to the project by continuously supporting it with time/dedicated resources as well as feedback, data and content contributions. + +
+ +
## August 23rd, 2022: Project Rebranding to OWASP MAS diff --git a/tools/scripts/structure_masvs.sh b/tools/scripts/structure_masvs.sh index 6065c0a5d2..d6a99dc0f0 100755 --- a/tools/scripts/structure_masvs.sh +++ b/tools/scripts/structure_masvs.sh @@ -1,8 +1,6 @@ mkdir docs/MASVS mkdir docs/MASVS/Intro mkdir docs/MASVS/Controls -mkdir docs/MASVS/Appendix -cp owasp-masvs/Document/0x*.md docs/MASVS -mv docs/MASVS/0x0[1-4]*.md docs/MASVS/Intro -mv docs/MASVS/0x*V[1-8]*.md docs/MASVS/Controls -mv docs/MASVS/0x9*.md docs/MASVS/Appendix \ No newline at end of file +cp owasp-masvs/Document/*.md docs/MASVS +mv docs/MASVS/0[1-4]*.md docs/MASVS/Intro +mv owasp-masvs/controls/* docs/MASVS/Controls \ No newline at end of file