PCI Standards and Application Security.

From my experience i am tried to identified the Controls/Requirement which come under Application Security bucket. This are the major controls, apart from that there are other controls which comes under different bucket's like Infrastructure Security, Process , Physical Security etc.

Requirement 6.3.7, 6.5, 6.6 , 11.3.2 talks about Application Security

PCI DSS Requirements - Application security

•6.3.7 Review custom code prior to release to production or customers, to identify potential coding vulnerabilities.

•6.5 Develop web software and applications based on secure coding guidelines such as the Open Web Application Security Project.

Review custom application code to identify coding vulnerabilities

•6.6 Ensure that all web-facing applications are protected against known attacks by applying either of the following methods:

–Having all custom application code reviewed for common vulnerabilities by an organization that specializes in application security

–Installing an application layer firewall in front of web-facing applications.

PCI DSS Requirement -Integrating Security in Software Develpoment Life cycle

•6 Develop and maintain secure systems and applications

PCI DSS Requirement -Application Penetration Testing

•11.3 Perform application-layer penetration tests at least yearly

–11.3.2 Application-layer penetration tests.

Common Top 10 web Vulnerabilities – PCI Equivalence

Major Vulnerabilities mention in PCI DSS Requirement 6.5

§6.5.1 Unvalidated input

§6.5.2 Broken access control

§6.5.3 Broken authentication and session management

§6.5.4 Cross-site scripting (XSS) attacks

§6.5.5 Buffer overflows

§6.5.6 Injection flaws (for example, Xpath injection ,SQL injection)

§6.5.7 Improper error handling

§6.5.8 Insecure storage

§6.5.9 Denial of service

§6.5.10 Insecure configuration management

Reference https://www.pcisecuritystandards.org/pdfs/navigating_pci_dss_v1-1.pdf

http://www.owasp.org/index.php/Top_10_2004

History before PCI- DSS- Compliance

PCI DSS stands for Payment Card Industry Data Security Standards.

The Payment Card Industry Security Standards Council was formed, and on the 15 December 2004 by Following Five major compaines.

Initially this compaines have there own security program.

1. Visa Card Information Security Program
2. MasterCard Site Data Protection
3. American Express Data Security Operating Policy
4. Discover Information and Compliance
5. JCB Data Security Program

PCI- Compliance - What it means to Organization

What is PCI- DSS?

The Payment Card Industry (PCI) Data Security Standard (DSS) is a worldwide standard mandated by Visa and MasterCard for the protection and Security of cardholder information.

To whom it applies

"Any organization that processes credit card information, including merchants and third-party service providers that store, process or transmit credit card/debit card data "

• Standards and requirements for data security
• Non-legislative, but enforceable through Fines

PCI DSS-“Digital Dozen”
Build and Maintain a Secure Network
1: Install and maintain a firewall configuration to protect cardholder data
2: Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
3: Protect stored cardholder data
4: Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program
5: Use and regularly update anti-virus software
6: Develop and maintain secure systems and applications
Implement Strong Access Control Measures
7: Restrict access to cardholder data by business need-to-know
8: Assign a unique ID to each person with computer access
9: Restrict physical access to cardholder data
Regularly Monitor and Test Networks
10: Track and monitor all access to network resources and cardholder data
11: Regularly test security systems and processes
Maintain an Information Security Policy
12: Maintain a policy that addresses information security

To Become a PCI Compliance we need Classify them in different buckets

No “single technology” makes company PCI compliant. Above figure shows the broad classification of all 12 Requirement controls.

Continue in part -2