X-Git-Url: https://git.martlubbers.net/?a=blobdiff_plain;f=report%2Freflection.asvs.tex;h=19c6c2ace19cdc5ba723bfced59b312d0367f335;hb=bf85c6f569c297c733227d532cbaec0dd663e985;hp=8f2272f6fa1999655ea49d921d8e318299fee8cc;hpb=332cc6edfadaa06cae8f790b8a0627bef705995e;p=ssproject1617.git diff --git a/report/reflection.asvs.tex b/report/reflection.asvs.tex index 8f2272f..19c6c2a 100644 --- a/report/reflection.asvs.tex +++ b/report/reflection.asvs.tex @@ -10,7 +10,7 @@ First, note how it presents itself as a \emph{simple checklist}, with as single the aim to be designed in such a way as to be easily transformed into automated penetration tests etc. Another typical way to present security concerns and measures would be to list appropriate security concerns - per type of architectural component of a web app, and thus integrate it into the development lifecycle. + per type of architectural component of a web app, and thus integrate it into the development life-cycle. We suspect the ASVS is presented the way it is, exactly because security is an \emph{emergent property}, and thus security measures should not be regarded as attachments to respective components of an app. Rather, it should be verified at each stage and level; and thus a checklist is a better presentation.