For Teachers · Back to the Module · Print with your browser's Print command.

A8 Worksheet: Tracing Findings to Security Requirements

Student Worksheet (about 20 minutes, Applied level)

Name: ______________________ Class: __________ Date: __________

Read first: A2

Learning Objectives

• [ ] Write a security requirement that can be checked.
• [ ] Use OWASP ASVS, CIS Controls and NIST CSF identifiers to trace findings.
• [ ] Show coverage: which requirements were checked and which were not.

Key Terms

Write each definition in your own words.

• Traceability: ______________________________________________
• Verification: ______________________________________________
• Evidence: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt checks --json and list the web checks that carry an ASVS identifier.
2. Rewrite three vague requirements from a project you know as specific, checkable statements.

Self-Check Questions

1. Which requirement can be verified?

• [ ] a) The site must be secure
• [ ] b) Responses must not reveal the web server version
• [ ] c) Security is a priority
• [ ] d) Hackers must be stopped

1. What does traceability link?

• [ ] a) Servers to cables
• [ ] b) Requirements to tests and findings to requirements
• [ ] c) Users to passwords
• [ ] d) Logs to backups

1. What is OWASP ASVS?

• [ ] a) A firewall product
• [ ] b) A list of verifiable web application security requirements
• [ ] c) A programming language
• [ ] d) A certificate authority

1. A requirement has no matching check. What should a report say?

• [ ] a) That it passed
• [ ] b) That it was not checked automatically and needs review
• [ ] c) Nothing
• [ ] d) That it failed

1. Why tag checks with standard identifiers?

• [ ] a) To make reports longer
• [ ] b) So findings can be grouped by requirement and compared across tools
• [ ] c) To hide the check name
• [ ] d) Because the law requires one standard

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• OWASP Application Security Verification Standard (ASVS): https://owasp.org/www-project-application-security-verification-standard/
• CIS Critical Security Controls: https://www.cisecurity.org/controls

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.