In version 1.1. of the PCI DSS (Payment Card Industry Data Security Standard), there are requirements for securing the application layer of a credit card handler's information system. This is a great step forward, imo, as it will address the layer with the majority of defects (finally) since we continue to write and buy\u00a0insecure software. However, there is a clause in requirement section #6 that states that PCI compliant systems must "ensure that all web-facing applications are protected against known attacks by applying either of the following methods: Having all custom application code reviewed for common vulnerabilities by an organization that specializes in application security Installing an application layer firewall in front of web-facing applications." Can someone explain to me how the PCI Security Standards Council views these as acceptable replacements for one another? I'm all in favor of utilizing web application firewalls (WAF) but they are no replacement for a\u00a0good solid code\u00a0review. Not to mention the mixed metaphor of whitebox (code review) vs\u00a0black box (WAF) mitigation strategies.\u00a0What company wouldn't choose the WAF? I certainly would as\u00a0the standard\u00a0currently reads -- it would probably be less expensive than a custom code review, it is persistent, and it meets the requirement. This requirement is currently considered a "best practice" by the PCI Standards Council; however, come June 2008, it will be a requirement and all companies must pass it to be PCI compliant. I must be missing _something here!