• United States



Chief Executive Officer, Security Innovation

Does the PCI Standards Council have a clue?

Mar 20, 20072 mins
Business ContinuityData and Information SecurityIT Leadership

In version 1.1. of the PCI DSS (Payment Card Industry Data Security Standard), there are requirements for securing the application layer of a credit card handler’s information system. This is a great step forward, imo, as it will address the layer with the majority of defects (finally) since we continue to write and buy insecure software.

However, there is a clause in requirement section #6 that states that PCI compliant systems must “ensure that all web-facing applications are protected against known attacks by applying either of the following methods:

  • Having all custom application code reviewed for common vulnerabilities by an organization that specializes in application security
  • Installing an application layer firewall in front of web-facing applications.”

Can someone explain to me how the PCI Security Standards Council views these as acceptable replacements for one another?

I’m all in favor of utilizing web application firewalls (WAF) but they are no replacement for a good solid code review. Not to mention the mixed metaphor of whitebox (code review) vs black box (WAF) mitigation strategies. 

What company wouldn’t choose the WAF? I certainly would as the standard currently reads — it would probably be less expensive than a custom code review, it is persistent, and it meets the requirement.

This requirement is currently considered a “best practice” by the PCI Standards Council; however, come June 2008, it will be a requirement and all companies must pass it to be PCI compliant.

I must be missing _something here!

Chief Executive Officer, Security Innovation

Ed Adams is a software executive with successful leadership experience in various-sized organizations that serve the IT security and quality assurance industries. As CEO, Mr. Adams applies his security and business skills, as well as his pervasive industry experience in the software quality space, to direct application security experts to help organizations understand the risks in their software systems and develop programs to mitigate those risks. The company has delivered high-quality risk solutions to the most recognizable companies in the world including Microsoft, IBM, Fedex, ING, Sony, Nationwide and HP.