Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These requirements are most prevalent in section six, but also appear in sections three, four, ten, and eleven. While there are many organizations that offer varying degrees of assistance with these requirements, only Fortify offers the ability to address all of these requirements. Fortify offers an all in one solution, called Fortify 360, which is made up of three analyzers: Fortify Static Code Analyzer (SCA): The number 1 source code analysis solution available, with a market share 10 times the second competitor Fortify Program Tracer Analyzer (PTA): An innovative approach to dynamic testing which finds vulnerabilities while a QA test is conducted Fortify Real Time Analyzer (RTA): An application shield that offers the most efficient and effective way to meet the application layer firewall requirement. This white paper will outline how Fortify can help companies address the following PCI mandates: Section 3 Section 4 Section 6 Section 10 Section 11 Section 3: Protect stored data 3.1 Keep cardholder data storage to a minimum. Develop a data retention and disposal policy. Limit storage amount and retention time to that which is required for business, legal, and/or regulatory purposes, as documented in the data retention policy. can identify instances where an application is inappropriately storing private information. The user specifies which input fields are accepting private data and which locations this data should not be stored to, and can quickly and easily analyze the source code to identify any violations. After a quick scan by, a user can see every location in the code where any piece of data designated as private is being stored.
protects deployed applications from storing private data when they shouldn t be. When an application is in production, watches every API inside the application and can identify if private data is being written to an insecure location. If it identifies this, can automatically mask this data. can also be programmed to notify an admin if data is being stored in a way that violates certain policies, e.g. if the data is being stored longer than a policy mandates it should be. 3.2 Do not store sensitive authentication data subsequent to authorization (even if encrypted). identifies and helps eliminate coding mistakes that allow inappropriate data to be stored. can analyze the application code and identify every location where an application is programmed to store sensitive authentication data. A user can take this information and easily edit the application to eliminate the storing of sensitive data. can automatically mask data that an application mistakenly stores. When an application is in production, can identify if an application is storing sensitive authentication data and automatically mask this data. 3.4 Render PAN, at minimum, unreadable anywhere it is stored (including data on portable digital media, backup media, in logs, and data received from or stored by wireless networks) by using any of the following approaches: Strong one-way hash functions (hashed indexes) Truncation Index tokens and pads (pads must be securely stored) Strong cryptography with associated key management processes and procedures. can identify data that contains sensitive data and ensure that it passes through the appropriate functions to either encrypt or sanitize the data in accordance with PCI s standards. s patented X-Tier Dataflow Analysis will track data across all the tiers of the application to ensure that all data is handled in a secure fashion. can be programmed to render any stored data unreadable by masking it. Section 4: Encrypt transmission of cardholder data across open, public networks 4.1 Use strong cryptography and security protocols such as secure sockets layer (SSL) / transport layer security (TLS) and Internet protocol security (IPSEC) to safeguard sensitive cardholder data during transmission over open, public networks. s X-Tier Dataflow Analysis will track information as it passes through approved encryption algorithms. Any data that is identified as sensitive and does not pass through an approved encryption API will be reported. can also ensure
that the encryption API is configured to use the appropriate encryption strength and constants through the use of its Control Flow and Symantec Engines. Section 6: Develop and maintain secure systems and applications 6.3 Develop software applications based on industry best practices and incorporate information security throughout the software development life cycle. 6.3.1 Testing of all security patches and system and software configuration changes before deployment 6.3.2 Separate development, test, and production environments 6.3.3 Separation of duties between development, test, and production environments 6.3.4 Production data (live PANs) are not used for testing or development 6.3.5 Removal of test data and accounts before production systems become active 6.3.6 Removal of custom application accounts, usernames, and passwords before applications become active or are released to customers 6.3.7 Review of custom code prior to release to production or customers in order to identify any potential coding vulnerability. can help identify where applications violate industry best practices. Fortify SCA can identify and help you remove any custom application accounts, usernames and passwords during development or during a security audit. specializes in identifying all major coding vulnerabilities. It draws on the largest database of secure coding rules available today. can prevent hackers from exploiting coding vulnerabilities. protects deployed applications by blocking attempts by hackers and malicious insiders to exploit vulnerabilities in your code. 6.5 Develop all web applications based on secure coding guidelines such as the Open Web Application Security Project guidelines. Review custom application code to identify coding vulnerabilities. Cover prevention of common coding vulnerabilities in software development processes, to include the following: 6.5.1 Unvalidated input 6.5.2 Broken access control (for example, malicious use of user IDs) 6.5.3 Broken authentication and session management (use of account credentials and session cookies) 6.5.4 Cross-site scripting (XSS) attacks 6.5.5 Buffer overflows 6.5.6 Injection flaws (for example, structured query language (SQL) injection) 6.5.7 Improper error handling 6.5.8 Insecure storage 6.5.9 Denial of service 6.5.10 Insecure configuration management
can identify all of the Open Web Application Security Project (OWASP) guidelines, along with numerous coding vulnerabilities. can identify and help you remove over 200 classes of vulnerabilities from your code. Fortify s internal Security Research Group studies coding vulnerabilities and how to exploit them. This elite team of security and coding experts helps Fortify customers stay ahead of the hacking community. can prevent hackers from exploiting coding vulnerabilities of the OWASP guidelines. protects deployed applications by blocking attempts by hackers and malicious Insiders to exploit vulnerabilities in your code. 6.6 Ensure that all web-facing applications are protected against known attacks by applying either of the following methods: Having all custom application code reviewed for common vulnerabilities by an organization that specializes in application security Installing an application layer firewall in front of web-facing applications. Note: This method is considered a best practice until June 30, 2008, after which it becomes a requirement. Using internally enables an organization to meet the first requirement. Fortify SCA analyzes the entire code base, identifying coding vulnerabilities and giving recommendations on how to remediate the issues. can help an organization pass the second requirement. meets all requirements for an application layer firewall and is significantly easier to use than hardware based application firewalls. installs on a Web application server and protects the application from the inside. This approach is extremely accurate and scales much more effectively than other solutions. Section 10: Track and monitor all access to network resources and cardholder data 10.1 Establish a process for linking all access to system components (especially access done with administrative privileges such as root) to each individual user. can help establish policies for access control between numerous components within your environment. 10.2 Implement automated audit trails for all system components to reconstruct the following events: 10.2.1 All individual user accesses to cardholder data 10.2.2 All actions taken by any individual with root or administrative privileges 10.2.3 Access to all audit trails
10.2.4 Invalid logical access attempts 10.2 5 Use of identification and authentication mechanisms 10.2.6 Initialization of the audit logs 10.2.7 Creation and deletion of system-level objects. constantly monitors all activity through your applications and can report on exactly what happened and when. can be programmed to go beyond monitoring and take specified or programmed actions. 10.3 Record at least the following audit trail entries for all system components for each event: 10.3.1 User identification 10.3.2 Type of event 10.3.3 Date and time 10.3.4 Success or failure indication 10.3.5 Origination of event 10.3.6 Identity or name of affected data, system component, or resource. monitors all activity and reports every one of the above requests. Section 11: Regularly test security systems and processes 11.3 Perform penetration testing at least once a year and after any significant infrastructure or application upgrade or modification (such as an operating system upgrade, a sub-network added to the environment, or a web server added to the environment). These penetration tests must include the following: 11.3.1 Network-layer penetration tests 11.3.2 Application-layer penetration tests. Fortify PTA Fortify PTA helps you meet 11.3.2, application-layer penetration tests. By analyzing the application during runtime, Fortify PTA identifies vulnerabilities that could be exploited to steal data, conduct a phishing attack, escalate privileges, etc. 11.4 Use network intrusion detection systems, host-based intrusion detection systems, and intrusion prevention systems to monitor all network traffic and alert personnel to suspected compromises. Keep all intrusion detection and prevention engines up-to-date. will monitor and has the option to protect all traffic that passes through the application. can alert specified personnel if a specified event occurs. Fortify RTA also receives necessary updates to keep informed of current hacking and fraud threats.