- Since its formation, PCI DSS has gone through several iterations in order to keep up with changes to the online threat landscape.
- While the basic rules for compliance have remained constant, new requirements are periodically added.
- One of the more significant of these additions was Requirement 6.6, introduced in 2008.
- It was established to secure data against some of the most common web application attack vectors, including SQL injections, RFIs and other malicious inputs.
- Using such methods, perpetrators can potentially gain access to a host of data—including sensitive customer information.
- Satisfying this requirement can be achieved either through application code reviews or by implementing a web application firewall (WAF).
- The first option includes a manual review of web application source code coupled with a vulnerability assessment of application security. It requires a qualified internal resource or third party to run the review, while final approval must come from an outside organization. Moreover, the designated reviewer is required to stay up-to-date on the latest trends in web application security to ensure that all future threats are properly addressed.
- Alternately, businesses can safeguard against application layer attacks by using a WAF, deployed between the application and clients. The WAF inspects all incoming traffic and filters out malicious attacks.