- Tools & Templates
- Security Jobs
- Data Protection
- Identity & Access
- Business Continuity
- Physical Security
- Security Leadership
Does the PCI Standards Council have a clue?
In version 1.1. of the PCI DSS (Payment Card Industry Data Security Standard), there are requirements for securing the application layer of a credit card handler's information system. This is a great step forward, imo, as it will address the layer with the majority of defects (finally) since we continue to write and buy insecure software.
However, there is a clause in requirement section #6 that states that PCI compliant systems must "ensure that all web-facing applications are protected against known attacks by applying either of the following methods:
- Having all custom application code reviewed for common vulnerabilities by an organization that specializes in application security
- Installing an application layer firewall in front of web-facing applications."
Can someone explain to me how the PCI Security Standards Council views these as acceptable replacements for one another?
I'm all in favor of utilizing web application firewalls (WAF) but they are no replacement for a good solid code review. Not to mention the mixed metaphor of whitebox (code review) vs black box (WAF) mitigation strategies.
What company wouldn't choose the WAF? I certainly would as the standard currently reads -- it would probably be less expensive than a custom code review, it is persistent, and it meets the requirement.
This requirement is currently considered a "best practice" by the PCI Standards Council; however, come June 2008, it will be a requirement and all companies must pass it to be PCI compliant.
I must be missing _something here!
Thanks to cloud computing, your business data is everywhere and being accessed by everyone. Making the wrong decision to protect your data can result in high costs, increased risk and executive exposure. View this live webinar on cloud security and the evolving data center, and learn why a data-centric approach to security is the best bet for today's virtual environment.
- Prevent Mobile Devices from Loading Dangerous Code
- Expanding Your Security Perimeter: Common Sense for Navigating Today's Threat Landscape
- Continuous Monitoring and Mitigation -- the New InfoSec Frontier
- RSA Security Analytics Case Study
- VMware Cloud Credits Program
- Insights from the 2013 IBM Chief Information Security Officer Assessment
- Cloud-based Cyber Security: A Hybrid Approach to Threat Detection and DDoS Mitigation IDC Technology Spotlight
- How Identity and Access Intelligence Will Revolutionize IAM
- Leveraging Managed Security Services to Fight Growing Cybersecurity Threats
- Global IT Trends: IT Outsourcing Fuels Business Growth
- Defending Against Increasingly Sophisticated Cyber Attacks
- Rethinking Your Enterprise Security - Critical Priorities to Consider