Source code reviews or web application firewalls?

By Michael Cobb | Jun 29, 2009

0 comments

Facebook

LinkedIn

Digg

Before you decide whether a source code review or Web application firewalls best meet your PCI DSS compliance needs, I recommend taking time to fully understand PCI's Web application requirements, including the clarification documents, and consider how the approved options mesh with your architecture and resources. It is now clear that enterprises have multiple paths to compliance and, if executed properly, any of the options will not only help achieve compliance, but also improve Web application security.

Of course, there is no one-size-fits-all approach to application security. Unless you are in the fortunate position to be able to both conduct code reviews and run a WAF, it looks like the choice may simply come down to people. Does the enterprise have staff that can:

• Configure and maintain an application-layer firewall?
• Perform a code review?
• Use a third-party vulnerability detection tool and fix any problems the review uncovers?

Of course, the decision could also depend upon architecture considerations and how well a WAF would work with existing systems and devices. A factor to consider, particularly for those leaning towards a third-party code review, is how comfortable the organization may be with the status of its code. Payment card applications develop over time and may include some legacy code of unknown origin and unclear purpose. Security staff may not want to remove legacy code and run the risk of breaking a mission-critical application. Placing a firewall in front of an application might be less costly, or less disruptive, than rewriting it in light of a code review.

Another approach is to use threat modeling to identify and evaluate the risks to an application. Take the top three critical risks and decide how best to remediate them: code review, vulnerability assessment or WAF. Be aware, though, that implementing a WAF will not eliminate the need for you to have a secure software development process in place (Requirement 6.3)! Application vulnerability assessments and code reviews both strengthen the development and quality assurance cycle.

Many of these choices are likely to be too costly for the small e-commerce site, so my recommendation here would be to outsource the payments to a third-party payment provider, which affectively outsources all of the expensive security requirements, including Web security, as well as the actual PCI DSS compliance. As long as you don't handle any of the card payments anywhere else, you don't need to be PCI DSS compliant.

0 comments

Facebook

LinkedIn

Digg