Comments on: Last call for WAF and Code Review http://www.mckeay.net/2008/06/30/last-call-for-waf-and-code-review/ The views of one man on security, privacy and anything else that catches his attention Fri, 21 Nov 2008 21:32:55 +0000 http://wordpress.org/?v=abc By: Mike http://www.mckeay.net/2008/06/30/last-call-for-waf-and-code-review/#comment-2497 Mike Tue, 01 Jul 2008 18:29:45 +0000 http://www.mckeay.net/2008/06/30/last-call-for-waf-and-code-review/#comment-2497 True that the validation aspect of PCI compliance requires that companies adhere to Requirement 6.6 (as of July 1, 2008), but has the bar really been raised? I mean people still need to secure their networks and at the end of the day this requirement is just meant to hedge a known attack vector that has emerged in the past few years ahead of others. Companies must stay one step ahead of the hacker. If they do, compliance is a simple exercise left to the reader. True that the validation aspect of PCI compliance requires that companies adhere to Requirement 6.6 (as of July 1, 2008), but has the bar really been raised? I mean people still need to secure their networks and at the end of the day this requirement is just meant to hedge a known attack vector that has emerged in the past few years ahead of others.

Companies must stay one step ahead of the hacker. If they do, compliance is a simple exercise left to the reader.

]]>