Showing posts from February, 2015

Application security and PCI-DSS

So, how does PCI-DSS affects our web application security testing or what to make sure the application is compliant with PCI, while doing the security testing.

Here are few requirements which needs to be taken case while testing a web application which handles financial data such as credit card information. As the PCI guidelines itself maintains that the application must be tested on regular basis in "Requirement 11: Regularly test security systems and processes."

But what should really we look for? The requirement 11 is tied back to other requirements Requirement 6.:

11.2.1 Perform quarterly internal vulnerability scans and rescans as needed, until all “high-risk” vulnerabilities (as identified in Requirement 6.1) are resolved. Scans must be performed by qualified personnel.

11.2.3 Perform internal and external scans, and rescans as needed, after any significant change. Scans must be performed by qualified personnel.

11.3 Implement a methodology for penetration testing tha…