Are You Testing Your Web Application for Vulnerabilities?

Automated scanners like Fortify and Checkmarx satisfy PCI DSS 6.3.2 but miss flaws found in manual review, especially authentication bugs, and false positives often overwhelm developers.

A New Year reminder that code review and penetration testing each miss vulnerabilities the other finds, so organizations should do both and remediate findings instead of delaying fixes.

PA-DSS payment application vendors can now satisfy requirement 5.2.a secure coding training through PCI Council-endorsed SANS courses, from OWASP Top 10 basics to language-specific tracks.

Healthcare organizations tackling PA-DSS should verify apps against the PCI SSC validated list by revision, press vendors for compliance plans, and require ongoing compliance in contracts.

We were asked by a customer about performing code review based on the PCI requirements.

I’ve always been a firm believer in incorporating manual testing as part of any security assessment; after all, a human is the best judge of evaluating the contents of application output, and best able to truly understand how an application is supposed to function.