For web applications and application interfaces (internal or external), are applications developed based on secure coding guidelines to protect applications from the following additional vulnerabilities: 6.5.7 Do coding techniques address cross-site scripting (XSS) Examine software-development vulnerabilities? policies and procedures Interview responsible personnel 6.5.8 Do coding techniques address improper access control Examine software-development such as insecure direct object references, failure to restrict policies and procedures URL access, directory traversal, and failure to restrict user Interview responsible personnel access to functions? 6.5.9 Do coding techniques address request forgery Examine software-development (CSRF)? policies and procedures Interview responsible personnel 6.5.10 Do coding techniques address broken authentication and Examine software-development session management? policies and procedures Note: Requirement 6.5.10 is a best practice until June 30, Interview responsible personnel 2015, after which it becomes a requirement.
For web applications and application interfaces (internal or external), are applications developed based on secure coding guidelines to protect applications from the following additional vulnerabilities: 6.5.7 Do coding techniques address cross-site scripting (XSS) vulnerabilities? Examine software-development policies and procedures Interview responsible personnel 6.5.8 Do coding techniques address improper access control such as insecure direct object references, failure to restrict URL access, directory traversal, and failure to restrict user access to functions? Examine software-development policies and procedures Interview responsible personnel 6.5.9 Do coding techniques address request forgery (CSRF)? Examine software-development policies and procedures Interview responsible personnel 6.5.10 Do coding techniques address broken authentication and session management? Note: Requirement 6.5.10 is a best practice until June 30, 2015, after which it becomes a requirement. Examine software-development policies and procedures Interview responsible personnel