For Teachers · Back to the Module · Print with your browser's Print command.

A8 Teacher Answer Key: Tracing Findings to Security Requirements

Teacher Answer Key (about 20 minutes, Applied level)

Name: ______________________ Class: __________ Date: __________

Read first: A2

Learning Objectives

• [ ] Write a security requirement that can be checked.
• [ ] Use OWASP ASVS, CIS Controls and NIST CSF identifiers to trace findings.
• [ ] Show coverage: which requirements were checked and which were not.

Key Terms

Write each definition in your own words.

• Traceability: Links between requirements, the tests that check them and the findings that break them.
• Verification: Confirming that a fix actually removed the weakness.
• Evidence: The observed data, such as a configuration line, that supports a finding.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt checks --json and list the web checks that carry an ASVS identifier.
2. Rewrite three vague requirements from a project you know as specific, checkable statements.

Self-Check Questions

1. Which requirement can be verified?

• [ ] a) The site must be secure
• [x] b) Responses must not reveal the web server version
• [ ] c) Security is a priority
• [ ] d) Hackers must be stopped
• Answer: b. A specific, observable statement can pass or fail.

1. What does traceability link?

• [ ] a) Servers to cables
• [x] b) Requirements to tests and findings to requirements
• [ ] c) Users to passwords
• [ ] d) Logs to backups
• Answer: b. Traceability shows what was tested and why a finding matters.

1. What is OWASP ASVS?

• [ ] a) A firewall product
• [x] b) A list of verifiable web application security requirements
• [ ] c) A programming language
• [ ] d) A certificate authority
• Answer: b. ASVS gives each web security requirement a stable identifier.

1. A requirement has no matching check. What should a report say?

• [ ] a) That it passed
• [x] b) That it was not checked automatically and needs review
• [ ] c) Nothing
• [ ] d) That it failed
• Answer: b. Unchecked is not the same as met. Honest reports show the gap.

1. Why tag checks with standard identifiers?

• [ ] a) To make reports longer
• [x] b) So findings can be grouped by requirement and compared across tools
• [ ] c) To hide the check name
• [ ] d) Because the law requires one standard
• Answer: b. Shared identifiers let teams map results to the requirements they follow.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• OWASP Application Security Verification Standard (ASVS): https://owasp.org/www-project-application-security-verification-standard/
• CIS Critical Security Controls: https://www.cisecurity.org/controls

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.