Overview
OWASP Mobile Application Security (MAS) is an OWASP flagship project whose mission is to define the industry standard for mobile application security. It provides a complete framework — a verification standard, a testing manual, and an assessment checklist — covering both Android and iOS. Security teams use it to verify app security, run penetration tests, define build requirements, and train staff.
MAS is widely referenced by app stores, enterprises, and regulators as a vendor-neutral baseline. Unlike a vulnerability top-10 list, it pairs prescriptive security requirements (MASVS) with concrete, reproducible test cases (MASTG), so the same controls can drive both secure development and independent assessment.
Components
The project ships three core deliverables that work together, plus a legacy ranking and an emerging weakness catalog:
- MASVS (Mobile Application Security Verification Standard) — the standard that defines what a secure mobile app must do, expressed as testable security controls grouped by domain.
- MASTG (Mobile Application Security Testing Guide) — a comprehensive manual of OS internals, reverse-engineering techniques, tools, and platform-specific test cases mapped back to MASVS controls.
- MAS Checklist — a spreadsheet/YAML artifact that links each MASVS control to the corresponding MASTG test cases, used to track and report assessment coverage.
- MASWE (beta) — Mobile Application Security Weakness Enumeration, a catalog of common mobile weaknesses bridging the standard and the testing guide.
- Mobile Top 10 — the legacy awareness ranking of common mobile risks, now superseded for verification by MASVS.
Core content
MASVS 2.x restructured the standard into eight technical control groups. Each group bundles the requirements for one security domain across both platforms:
- MASVS-STORAGE — protect sensitive data stored on the device and prevent unintended leakage through backups, logs, or IPC.
- MASVS-CRYPTO — use strong, correctly configured cryptography and manage keys securely.
- MASVS-AUTH — enforce sound authentication and authorization, including secure handling of credentials and biometrics.
- MASVS-NETWORK — secure all network communication with TLS and validate the server identity.
- MASVS-PLATFORM — interact safely with platform APIs, WebViews, IPC, and the surrounding mobile OS.
- MASVS-CODE — maintain code quality and keep third-party dependencies patched and free of known vulnerabilities.
- MASVS-RESILIENCE — resist reverse engineering and tampering through defense-in-depth hardening measures.
- MASVS-PRIVACY — protect user privacy and handle personal data transparently and in line with regulations.
How it's used
MAS supports the full mobile security lifecycle. Developers use MASVS as a requirements catalog to define a target security level before coding; testers follow the MASTG methodology — static analysis, dynamic instrumentation, traffic interception, and reverse engineering — to validate each control on real devices and emulators for both iOS and Android.
- Mobile penetration testing with a repeatable, evidence-based methodology.
- App store and enterprise verification against a recognized security baseline.
- Defining and contracting security requirements for in-house or vendor-built apps.
- Security training and building hands-on skills with the MAS Crackmes challenge apps.
History & versions
The project grew from two parallel efforts: the Mobile Application Security Verification Standard (MASVS) and the Mobile Security Testing Guide (originally MSTG). In April 2023, MASVS 2.0 delivered a major refactor that simplified and reorganized the controls into the modern technical groups and renamed MSTG to MASTG, consolidating everything under the unified 'OWASP MAS' brand.
MASVS v2.1.0 (January 2024) added the MASVS-PRIVACY group and CycloneDX SBOM support, and is the current standard version. MASTG v1.7.0 (October 2024) completed the second phase of the testing-guide refactor, splitting content into Tests, Techniques, Tools, and Reference Apps to align with MASVS 2.x.