- Tools & Templates
- Security Jobs
- Data Protection
- Identity & Access
- Business Continuity
- Physical Security
- Security Leadership
Does the PCI Standards Council have a clue?
In version 1.1. of the PCI DSS (Payment Card Industry Data Security Standard), there are requirements for securing the application layer of a credit card handler's information system. This is a great step forward, imo, as it will address the layer with the majority of defects (finally) since we continue to write and buy insecure software.
However, there is a clause in requirement section #6 that states that PCI compliant systems must "ensure that all web-facing applications are protected against known attacks by applying either of the following methods:
- Having all custom application code reviewed for common vulnerabilities by an organization that specializes in application security
- Installing an application layer firewall in front of web-facing applications."
Can someone explain to me how the PCI Security Standards Council views these as acceptable replacements for one another?
I'm all in favor of utilizing web application firewalls (WAF) but they are no replacement for a good solid code review. Not to mention the mixed metaphor of whitebox (code review) vs black box (WAF) mitigation strategies.
What company wouldn't choose the WAF? I certainly would as the standard currently reads -- it would probably be less expensive than a custom code review, it is persistent, and it meets the requirement.
This requirement is currently considered a "best practice" by the PCI Standards Council; however, come June 2008, it will be a requirement and all companies must pass it to be PCI compliant.
I must be missing _something here!
Thanks to cloud computing, your business data is everywhere and being accessed by everyone. Making the wrong decision to protect your data can result in high costs, increased risk and executive exposure. View this live webinar on cloud security and the evolving data center, and learn why a data-centric approach to security is the best bet for today's virtual environment.
- Enterprise File Sharing: All You Need to Know
- Forrester Research and EMC on Continuous Availability
- Big Ideas; Big Tech-Continuous Availability for VMware
- Security Analytics Video
- Reduce Costs, Maximize Performance and Ensure High Availability of your Business Critical Applications
- B2B Integration on Cloud: Real World Solutions and Technology Advances