Code Reviews and Compliance - Revision history

Thomas Herlea: Removed an editorial message from the content part

2010-09-09T15:44:13Z

Removed an editorial message from the content part

Thomas Herlea: Added navigation to facilitate sequential reading online

2010-09-09T15:39:22Z

Added navigation to facilitate sequential reading online

KirstenS: Code Reviews and compliance moved to Code Reviews and Compliance

2009-01-16T13:51:39Z

Code Reviews and compliance moved to Code Reviews and Compliance

KirstenS: /* Code Review Requirements */

2009-01-11T13:26:14Z

‎Code Review Requirements

KirstenS at 13:22, 11 January 2009

2009-01-11T13:22:51Z

KirstenS at 19:41, 2 September 2008

2008-09-02T19:41:04Z

Davidrook: /* Code Review Requirements */

2008-08-01T15:38:12Z

‎Code Review Requirements

EoinKeary at 16:52, 1 July 2008

2008-07-01T16:52:39Z

Davidrook: /* Introduction */

2008-07-01T08:57:58Z

‎Introduction

Davidrook: /* Code Review Requirements */

2008-06-29T21:14:57Z

‎Code Review Requirements

@@ Line 5: / Line 5: @@
 }}
 __TOC__
 == Introduction ==

@@ Line 1: / Line 1: @@
-[[OWASP Code Review Guide Table of Contents]]__TOC__
+{{LinkBar
 Retrieved from [[Code Review Metrics]]
@@ Line 39: / Line 44: @@
 The PCI Council expanded option one to include internal resources performing code reviews. This added weight to an internal code review and should provide an additional reason to ensure this process is performed correctly.
 [[Category:OWASP Code Review Project]]

@@ Line 11: / Line 11: @@
 == Code Review Requirements ==
-The PCI standard contains several points relating to secure application development but we will focus solely on the points which mandate code reviews here. All of the points relating to code reviews can be found in requirement 6:  Develop and maintain secure systems and applications. Specifically requirement 6.3.7 mandates a code review of custom code:
+The PCI standard contains several points relating to secure application development, but we will focus solely on the points which mandate code reviews here. All of the points relating to code reviews can be found in requirement 6: Develop and maintain secure systems and applications. Specifically requirement 6.3.7 mandates a code review of custom code:
 '''6.3.7 - Review of custom code prior to release to production or customers in order to identify any potential coding vulnerability.'''<br>
@@ Line 17: / Line 17: @@
 This requirement could be interpreted to mean that the code review must consider other PCI requirements, namely:
-'''6.3.5 - Removal of custom application accounts, usernames and passwords before applications become active or are released to customers'''<br>
+'''6.3.5 - Removal of custom application accounts, usernames, and passwords before applications become active or are released to customers'''<br>
 '''6.5 - Develop all web applications based on secure coding guidelines such as the Open Web Application Security Project guidelines. Review custom application code to identify coding vulnerabilities. Cover prevention of common coding vulnerabilities in software development processes, to include the following:'''<br>
@@ Line 32: / Line 32: @@
 .5.10 Insecure configuration management<br>
-The standard does not discuss specific methodologies that need to be followed so any of the approaches outlined in this guide could be used.
+The standard does not discuss specific methodologies that need to be followed, so any of the approaches outlined in this guide could be used.  The current version of the standard (version 1.1 at the time of writing) introduced requirement 6.6. This requirement gave companies two options:<br>
 '''1) Having all custom application code reviewed for common vulnerabilities by an organisation that specialises in application security'''
 '''2) Installing an application layer firewall in front of web-facing applications'''
 The PCI Council expanded option one to include internal resources performing code reviews. This added weight to an internal code review and should provide an additional reason to ensure this process is performed correctly.
 [[Category:OWASP Code Review Project]]

← Older revision		Revision as of 13:22, 11 January 2009
Line 1:		Line 1:
	[[OWASP Code Review Guide Table of Contents]]__TOC__		[[OWASP Code Review Guide Table of Contents]]__TOC__
		+
		+	Retrieved from [[Code Review Metrics]]
		+
	== Introduction ==		== Introduction ==

← Older revision		Revision as of 19:41, 2 September 2008
Line 1:		Line 1:
		+	[[OWASP Code Review Guide Table of Contents]]__TOC__
	== Introduction ==		== Introduction ==

Line 39:		Line 40:

	The PCI Council expanded option one to include internal resources performing code reviews. This added weight to an internal code review and should provide an additional reason to ensure this process is performed correctly.		The PCI Council expanded option one to include internal resources performing code reviews. This added weight to an internal code review and should provide an additional reason to ensure this process is performed correctly.
		+	[[Category:OWASP Code Review Project]]

← Older revision	Revision as of 13:51, 16 January 2009
(No difference)

← Older revision		Revision as of 16:52, 1 July 2008
Line 1:		Line 1:
−	~~Author: David Rook~~	+

	== Introduction ==		== Introduction ==

← Older revision		Revision as of 08:57, 1 July 2008
Line 1:		Line 1:
		+	Author: David Rook
		+
	== Introduction ==		== Introduction ==