OWASP MASVS
OWASP MASVS, and the four resilience controls
What the mobile security standard asks for, where resilience fits and how to see where your app stands today.
Short answer
The OWASP Mobile Application Security Verification Standard (MASVS) is OWASP's standard for mobile app security requirements. It groups controls into eight categories, from STORAGE to PRIVACY. MASVS-RESILIENCE is the category about resisting reverse engineering and tampering, with four controls: platform integrity, anti-tampering, anti-static analysis and anti-dynamic analysis.
MASVS, MASTG and MASWE
MASVS says what to verify. The OWASP Mobile Application Security Testing Guide (MASTG) says how to test it, with techniques and tools, and the weakness enumeration links requirements to concrete problems. Security reviews and pentests often use the three together.
Why resilience matters for apps that move money
The other categories protect data and communication when the device is trusted. Resilience covers the case where it is not: a rooted phone, an instrumented app or a modified copy. That is the situation attackers create when they go after apps that move money.
How to use it
Map each control to what your app does today, find the gaps, and fix the configuration problems first, because they are cheap. Then add runtime protection and hardening for the resilience controls, and keep evidence of each change for reviews.
What the sources say
MASVS groups its controls into eight categories: STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE and PRIVACY.
Source · checked on
MASVS-RESILIENCE-1: the app validates the integrity of the platform.
Source · checked on
MASVS-RESILIENCE-2: the app implements anti-tampering mechanisms.
Source · checked on
MASVS-RESILIENCE-3: the app implements anti-static analysis mechanisms.
Source · checked on
MASVS-RESILIENCE-4: the app implements anti-dynamic analysis techniques.
Source · checked on
What Moatgator does
The free Scan grades an APK, AAB or IPA from A to F with findings mapped to OWASP MASVS-RESILIENCE.
Source · checked on
Shield covers anti-static analysis with obfuscation of the compiled app.
Source · checked on
Runtime covers platform integrity, anti-tampering and anti-dynamic analysis with detections that respond by policy.
Source · checked on
Where it stops
A grade from a static scan reads the package; it does not replace a pentest or a full MASVS review, and passing every control does not make an app impossible to attack.
Frequently asked questions
Is MASVS a certification?
No. It is a verification standard. Organizations use it to define requirements and to structure security reviews and pentests.
Which MASVS version should I use?
Use the current version published by OWASP at mas.owasp.org, which defines the eight categories and the four resilience controls described here.
Does every app need MASVS-RESILIENCE?
Not every app. It matters most for apps that hold money, credentials or valuable content, where attackers invest in reverse engineering.
How do I check my app quickly?
Upload the APK, AAB or IPA to the free Scan. It reads the package and maps what it finds to the resilience controls, without an account.
See where your app stands
Upload an APK, AAB or IPA to the free Scan and get a grade, without an account.