There’s been some recent chatter and speculation on the upcoming enhancement to the PCI standard. Among the discussions, I’d like to publicize my opinion on one argument I’ve heard multiple times during the last few days. The argument goes something like this: The cost of performing security code reviews is too high, but the cost of performing black box reviews and/or implementing web application firewalls is lower. Therefore, the solution is to recommend that organizations rely on penetration assessments and/or web application firewalls.

At ONLamp.

[ Read more ]