PCI DSS v4.0/Requirement 06: Develop and Maintain Secure Systems and Software/90 of 250
6.4.2Public-facing web applications are protected against attacks
Control family: Requirement 06: Develop and Maintain Secure Systems and Software
Control description
Defined Approach Requirements:
For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks, with at least the following:
- Is installed in front of public-facing web applications and is configured to detect and prevent web-based attacks.
- Actively running and up to date as applicable.
- Generating audit logs.
- Configured to either block web-based attacks or generate an alert that is immediately investigated.
Defined Approach Testing Procedures:
6.4.2 For public-facing web applications, examine the system configuration settings and audit logs,and interview responsible personnel to verify that an automated technical solution that detects and prevents web-based attacks is in place in accordance with all elements specified in this requirement.