PCI DSS Secure Coding Workshop

Secure coding training from application security experts

Contact Us

Overview

PCI DSS Requirement 6.5

The Payment Card Industry Data Security Standard (PCI DSS) requires that organisations developing applications that handle card data secure their software against common vulnerabilities. As part of this, PCI DSS compliant organisations need to train their software developers in secure coding techniques.

Our PCI DSS Secure Coding Workshop

This is where we come in. 4ARMED’s consultants have been helping organisations implement PCI DSS since 2006, we’ve also been writing code and hacking web applications all that time too so we put all that together into an intensive half-day workshop that we can deliver on site at your office, our office or another location of your choosing.

Our PCI DSS Secure Coding training aims to provide developers with an understanding of the issues highlighted in PCI DSS requirement 6.5, how they manifest themselves, how hackers find them and what the impact can be and then, most importantly, we explain how to code defensively to prevent these weaknesses. We explain what works and what doesn’t and some common issues we encounter during our penetrating testing engagements.

Security Testing Levels

Level 1 - Opportunistic

The target is reviewed for easy to discover, easy to exploit weaknesses, such as those found in the OWASP Top Ten, that would be targeted by opportunistic attackers that lack the resources, skills, motivation or time to pursue more difficult vulnerabilities.

Level 2 - Standard

The target is reviewed to see if it will withstand most security risks associated with today’s software. This level of testing is typically required for most enterprise systems, compliance standards and other platforms that handle sensitive information such as personal or financial data.

Level 3 - Advanced

This level is typically reserved for those systems that require the highest level of assurance, where a compromise could result in critical impact. At this level the types of threat are expected to be determined and potentially well-funded. Security testing alone is not sufficient to provide verification and we would look to review the system’s architecture, code, management processes and other supporting factors in order to provide deep insight into the system’s risk.

If what you need is something more targeted or bespoke, this is no problem. For example, you may have recently rolled out a new login function and would like assurance over just this element. All our engagements are built around your requirements so let us know what you need.