// GLOSSARY

OWASP MASVS / MASTG

The Mobile Application Security Verification Standard (MASVS) and the Mobile Application Security Testing Guide (MASTG). One defines the security control requirements a mobile application must meet, the other gives the methodological framework for how those requirements are tested; the role ASVS plays for web is taken up in the mobile world by this pair. It is the ground reference in the mobile scope of the Application Security Penetration Test. The need for a separate standard arises because mobile has its own attack surface, different from web: the application runs on a device physically in the user's hand, that is, one the attacker can also control. This brings questions web methodology cannot cover; sensitive data in local storage, safe use of platform APIs, over-reliance on the client side, certificate pinning and resistance to reverse engineering are mobile-specific validation areas. This framework is needed to test a mobile application not only against threats from network traffic but also against those from the device itself.