PCI 6:: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
No edit summary |
||
| (One intermediate revision by the same user not shown) | |||
| Line 1: | Line 1: | ||
== Requirement 6: Develop and maintain secure systems and applications. == | == Requirement 6: Develop and maintain secure systems and applications and implement Strong Access Control Measures. == | ||
* Unscrupulous individuals use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed via vendor security patches, and all systems should have current software patches to protect against exploitation by employees, external hackers, and viruses. For in-house developed applications, numerous vulnerabilities can be avoided by using standard system development processes and secure coding techniques.<br> | * Unscrupulous individuals use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed via vendor security patches, and all systems should have current software patches to protect against exploitation by employees, external hackers, and viruses. For in-house developed applications, numerous vulnerabilities can be avoided by using standard system development processes and secure coding techniques.<br> | ||
| Line 51: | Line 51: | ||
:'''PCI-6.5 Develop web software and applications based on secure coding guidelines such as the Open Web Application Security Project guidelines. Review custom application code to identify coding vulnerabilities.'''<br> | :'''PCI-6.5 Develop web software and applications based on secure coding guidelines such as the Open Web Application Security Project guidelines. Review custom application code to identify coding vulnerabilities.'''<br> | ||
<br> | <br> | ||
::*See www.owasp.org - “The Ten Most Critical Web Application Security Vulnerabilities.” <br> | ::*See [http://www.owasp.org www.owasp.org] - “The Ten Most Critical Web Application Security Vulnerabilities.” <br> | ||
<br> | <br> | ||
:*'''Cover prevention of common coding vulnerabilities in software development processes, to include:'''<br> | ::*'''Cover prevention of common coding vulnerabilities in software development processes, to include:'''<br> | ||
<br> | <br> | ||
::[[Image:Key-control.jpg]][[PCI-6.5.1:|PCI-6.5.1 Unvalidated input.]]<br> | ::[[Image:Key-control.jpg]][[PCI-6.5.1:|PCI-6.5.1 Unvalidated input.]]<br> | ||
Latest revision as of 18:46, 28 February 2007
Requirement 6: Develop and maintain secure systems and applications and implement Strong Access Control Measures.
- Unscrupulous individuals use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed via vendor security patches, and all systems should have current software patches to protect against exploitation by employees, external hackers, and viruses. For in-house developed applications, numerous vulnerabilities can be avoided by using standard system development processes and secure coding techniques.
- PCI-6.1 Ensure that all system components and software have the latest vendor-supplied security patches.
- PCI-6.3 Develop software applications based on industry best practices and include information security throughout the software development life cycle.
- Include the following:
- PCI-6.4 Follow change control procedures for all system and software configuration changes.
- The procedures should include the following:
- PCI-6.5 Develop web software and applications based on secure coding guidelines such as the Open Web Application Security Project guidelines. Review custom application code to identify coding vulnerabilities.
- See www.owasp.org - “The Ten Most Critical Web Application Security Vulnerabilities.”
- See www.owasp.org - “The Ten Most Critical Web Application Security Vulnerabilities.”
- Cover prevention of common coding vulnerabilities in software development processes, to include:
- Cover prevention of common coding vulnerabilities in software development processes, to include:
- Implement Strong Access Control Measures.
- Implement Strong Access Control Measures.
--Mdpeters 11:25, 7 July 2006 (EDT)