ASVS V9: Communications
Requirements for protecting data in transit — TLS version, certificate validation, and cleartext traffic prevention.
Why It Matters
Every ASVS V9 requirement exists to prevent the same class of interception risk described in OWASP Mobile M5 — this chapter is the verification-standard formulation of the same underlying concern, at a testable control level.
Application to Application Security
Directly maps to mobile-specific checks: enforcing TLS 1.2+, flagging Android cleartext-traffic exceptions and iOS ATS exceptions, and validating that certificate pinning bypasses aren't present in production builds.
Relation to Software Development
V9 controls are typically implemented once in a shared networking layer, which is good for consistency but means a single misconfiguration there affects every API call the app makes.
How Strata Surfaces This
The same detection Strata applies to OWASP M5 — cleartext URL scanning, manifest and Info.plist exception parsing, TLS/cipher suite analysis — is what verifies ASVS V9 compliance in practice.
Developer guidance
Centralize network configuration in one place so a TLS policy fix applies everywhere at once, and audit bundled SDKs for network calls that bypass your app's own networking layer.
Management guidance
Ask whether third-party SDKs have been audited for their own network behavior — a compliant app-level TLS policy doesn't cover traffic an SDK sends independently.