Standards
OWASP MASVS resilience controls
and runtime checks
OWASP MASVS is the industry standard of security requirements for mobile apps, and its resilience category asks apps to validate the platform, resist tampering, and resist static and dynamic analysis. Runtime protection and obfuscation are two ways to meet those ideas.
What is OWASP MASVS?
MASVS is OWASP's standard of security requirements for mobile apps, and the OWASP Mobile Application Security Testing Guide (MASTG) explains how to test them. The requirements are grouped by category so teams can check each area of an app: storage, cryptography, authentication, network, platform interaction, code quality, resilience and privacy.
What does MASVS-RESILIENCE ask for?
The resilience category is about making an app harder to reverse engineer and tamper with. It covers four ideas:
- Platform integrity: the app validates that the platform it runs on has not been compromised.
- Anti-tampering: the app detects modification of its own code and resources.
- Anti-static analysis: the app resists being read and analysed offline, for example through obfuscation.
- Anti-dynamic analysis: the app resists being inspected while it runs, for example by debuggers and instrumentation such as Frida.
How runtime protection relates to these controls
Several of these ideas are implemented as runtime checks: detecting rooted or jailbroken devices, hooking frameworks, debuggers and repackaged apps. Obfuscation addresses static analysis at build time instead. Resilience controls raise the cost of an attack but do not replace secure coding and server-side controls. Mobile RASP guide → · Detecting Frida → · RASP vs shielding →
Where regulators refer to OWASP
NPCI's circular for UPI apps lists protection against OWASP Top 10 vulnerabilities, including security testing with SAST, DAST and software composition analysis, as a mandatory control. That is a different OWASP list from MASVS but shows how regulators lean on OWASP material. NPCI circular →
Frequently asked questions
What is OWASP MASVS?
The OWASP Mobile Application Security Verification Standard is a set of security requirements for mobile apps, grouped into categories such as storage, cryptography, authentication, network, platform, code, resilience and privacy.
What does MASVS-RESILIENCE cover?
It covers resistance to reverse engineering and tampering: validating the integrity of the platform, anti-tampering, anti-static analysis and anti-dynamic analysis.
Is MASVS a regulation?
No. It is an industry standard. Regulators such as NPCI refer to OWASP in their own requirements, for example requiring protection against the OWASP Top 10 for UPI apps, but that is a separate list from MASVS.
Does RASP satisfy MASVS?
Runtime protection helps with several resilience controls, but MASVS also covers storage, cryptography, authentication and network security that RASP does not replace.
See it on your app.
Book a free 30-day shadow pilot, or download the platform brochure.