[PCI_DSS] Requirement 6: Develop and maintain secure systems and applications [Archive] - PCI DSS FAQ - Payment Card Industry (PCI) Data Security Standard Discussion Forum

6.1 Ensure that all system components and software have the latest vendor-supplied security patches installed. Install relevant security patches within one month of release.
6.2 Establish a process to identify newly discovered security vulnerabilities (for example, subscribe to alert services freely available on the Internet). Update standards to address new vulnerability issues.
6.3 Develop software applications based on industry best practices and incorporate information security throughout the software development life cycle.
6.3.1 Testing of all security patches and system and software configuration changes before deployment
6.3.2 Separate development, test, and production environments
6.3.3 Separation of duties between development, test, and production environments
6.3.4 Production data (live PANs) are not used for testing or development
6.3.5 Removal of test data and accounts before production systems become active
6.3.6 Removal of custom application accounts, usernames, and passwords before applications become active or are released to customers
6.3.7 Review of custom code prior to release to production or customers in order to identify any potential coding vulnerability.
6.4 Follow change control procedures for all system and software configuration changes. The procedures must include the following:
6.4.1 Documentation of impact
6.4.2 Management sign-off by appropriate parties
6.4.3 Testing of operational functionality
6.4.4 Back-out procedures
6.5 Develop all web applications based on secure coding guidelines. such as the Open Web Application Security Project Guidelines. Review custom application code to identify coding vulnerabilities. Cover prevention of common coding vulnerabilities in software development processes, to include the following:
6.5.1 Unvalidated input
6.5.2 Broken access control (for example, malicious use of user IDs)
6.5.3 Broken authentication and session management (use of account credentials and session cookies)
6.5.4 Cross-site scripting (XSS) attacks
6.5.5 Buffer overflows
6.5.6 Injection flaws (for example, structured query language (SQL) injection)
6.5.7 Improper error handling
6.5.8 Insecure storage
6.5.9 Denial of service
6.5.10 Insecure configuration management
6.6 Ensure that all web-facing applications are protected against known attacks by either of the following methods: * Having all custom application code reviewed for common vulnerabilities by an organization that specializes in application security * Installing an application-layer firewall in front of web-facing applications Note: This method is considered a best practice until June 30, 2008, after which it becomes a requirement.