The New PCI Requirement: Application Firewall Vs. Code Review

Overview

Those enterprises which handles credit card information, must meet the requirements under the new Payment Card Industry Data Security Standard version 1.1 (PCI DSS). With PCI requirement 6.6, the brand new Web application security requirement, and its company's choice - they can have their code reviewed by an external company or they can install a Web Application Firewall. This paper details PCI requirement 6.6, the issues, the products involved, and the costs associated with choosing a code review versus selecting an application firewall.