Re: PCI: DSS

[Adriel Desautels <adriel () netragard com>]

Pete,
	You could try using ModSecurity. Its fast, free and effective at 
protecting web applications.

Regards,
        Adriel T. Desautels
        Chief Technology Officer
        Netragard, LLC.
        Office : 617-934-0269
        Mobile : 617-633-3821
        http://www.linkedin.com/pub/1/118/a45

        Join the Netragard, LLC. Linked In Group:
        http://www.linkedin.com/e/gis/48683/0B98E1705142

---------------------------------------------------------------
Netragard, LLC - http://www.netragard.com  -  "We make IT Safe"
Penetration Testing, Vulnerability Assessments, Website Security

Netragard Whitepaper Downloads:
-------------------------------
Choosing the right provider : http://tinyurl.com/2ahk3j
Three Things you must know  : http://tinyurl.com/26pjsn


Hill, Pete wrote:
>  
> Hi all,
>
> Can anyone confirm for me what sort of workarounds there are concerning
> PCI:DSS and application layer firewalls?
>
> Requirement 6.6 of the standard states this:
>
> 6.6 Ensure that all web-facing applications are protected against known
> attacks by applying either of
> the following methods:
> * Having all custom application code reviewed for common vulnerabilities
> by an organization
> that specializes in application security
> * Installing an application layer firewall in front of web-facing
> applications.
> Note: This method is considered a best practice until June 30, 2008,
> after which it becomes a
> requirement.
>
> We already have our custom code reviewed, but Im wondering if I
> absolutely must sort out an application layer firewall or if there is a
> workaround that would be acceptable for a level 1 merchant.
>
> If there are any knowledgeable auditors (qsa etc) out there I'd really
> appreciate your help on this one.
>
> Many thanks
> Pete
>
>
> A number of bogus e-mails are currently circulating in the UK encouraging customers to visit fraudulent websites where 
> personal or Internet security details are requested. Bid tv/Price-drop tv/Speed auction tv would never send e-mails 
> that ask for confidential, personal security information or details regarding your account status.
>
> The content of this e-mail does not constitute a contract and any matters discussed herein remain subject to contract.
>
> The contents of this message and all attachments have been sent in confidence for the attention of the addressee only.  
> If you are not the intended recipient you are kindly requested to preserve this confidentiality and to advise the 
> sender immediately of the error in transmission.
>
> "sit-up ltd, registered in England No: 03877786.
> Registered Office: Sit-Up House, 179-181 The Vale, London W3 7RW.
> Sit-Up ltd is wholly owned by a subsidiary of Virgin Media."