Skip to main content

💼 6.5 Address common coding vulnerabilities in software-development processes.

  • ID: /frameworks/pci-dss-v3.2.1/06/05

Description​

As follows:

  • Train developers at least annually in up-to-date secure coding techniques, including how to avoid common coding vulnerabilities.
  • Develop applications based on secure coding guidelines.

The vulnerabilities listed at 6.5.1 through 6.5.10 were current with industry best practices when this version of PCI DSS was published. However, as industry best practices for vulnerability management are updated (for example, the OWASPGuide, SANS CWE Top 25, CERT Secure Coding, etc.), the current best practices must be used for these requirements.

Similar​

  • Sections
    • /frameworks/pci-dss-v4.0/06/02/02
  • Internal
    • ID: dec-c-61590095

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 PCI DSS v4.0 → 💼 6.2.2 Software development personnel working on bespoke and custom software are trained at least once every 12 months.no data

Similar Sections (Give Policies To)​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 PCI DSS v4.0 → 💼 6.2.2 Software development personnel working on bespoke and custom software are trained at least once every 12 months.no data

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 6.5.1 Injection flaws, particularly SQL injection. Also consider OS Command Injection, LDAP and XPath injection flaws as well as other injection flaws.1no data
💼 6.5.2 Buffer overflows.1no data
💼 6.5.3 Insecure cryptographic storage.1no data
💼 6.5.4 Insecure communications.1no data
💼 6.5.5 Improper error handling.1no data
💼 6.5.6 All “high risk” vulnerabilities identified in the vulnerability identification process.1no data
💼 6.5.7 Cross-site scripting (XSS).1no data
💼 6.5.8 Improper access control.1no data
💼 6.5.9 Cross-site request forgery (CSRF).1no data
💼 6.5.10 Broken authentication and session management.1no data