V9 rework needed

[tghosth]

I have ready V9 and I think it needs some rework.

Overall I think it is trying to distinguish between external facing services and service to service comms and also trying to distinguish between TLS and other encryption mechanisms.

I have started by trying to make this differentiation clearer but I am keen to get other feedback from people.

[elarlang]

V9 title is general "Communications" but content seems to be only for encryption oriented.

If to keep it only for communication encryption, then maybe it makes sense to make title more precise as well.

If to not keep it only for encryption, I would like to put new subcategory for communications for CSRF and Origin header checks - basically requirements for validation, is the request originated from expected party. Requirement like current:

• 4.2.2
• 4.2.3
• 13.5.2
• 14.5.3

[tghosth]

Ok so what everything in V9 has in common which is not the case for the 4 requirements you specified is that the server-side configuration would almost certainly be outside of the application code/config but rather at the server or service hosting level.

if you can think of other comms related items that fall into that bucket then we can look at them but I think the other items you have pointed out are application code/config related so belong wherever they currently are.

[elarlang]

I think the other items you have pointed out are application code/config related so belong wherever they currently are.

That's the problem, that they are not - CSRF is not authorization problem and does not belong to V4. Those 4 belong together to one (sub)category, but it does not mean it must be V9. That's why I asked, how do we define the category name "Communication".

[tghosth]

You think that CSRF is more of a configuration problem?

[elarlang]

If current V9 is purely for configuration, should it be part of V14 then?

[tghosth]

But it is a special kind of configuration which is a little outside of the regular application domain and it is also an important topic which is why I think it merits its own section. I agree that things are getting a little murky now but I think it makes enough sense where it is.

[elarlang]

Then I stand for this:

If to keep it only for communication encryption, then maybe it makes sense to make category title more precise as well.

https://github.com/OWASP/ASVS/issues/1220#issuecomment-1035200681

[tghosth]

Can we say "Communication Protection"?

[tghosth]

Can we say "Communication Protection"? @elarlang what do you think?

[elarlang]

In my head I can fit all CSRF, Origin, CORS etc related requirements under this title.

If to keep current structure, the category name should contain TLS

[tghosth]

Ok so "Communication Encryption"? @elarlang

[elarlang]

Seems good

[tghosth]

Created #1342 @elarlang