For web applications and application interfaces (internal or external), are applications developed based on secure coding guidelines to protect applications from the following additional vulnerabilities: 6.5.7 Do coding techniques address cross-site scripting Examine software-development (XSS) vulnerabilities? policies and procedures Interview responsible personnel 6.5.8 Do coding techniques address improper access control Examine software-development such as insecure direct object references, failure to policies and procedures restrict URL access, directory traversal, and failure to Interview responsible personnel restrict user access to functions? 6.5.9 Do coding techniques address cross-site request Examine software-development forgery (CSRF)? policies and procedures Interview responsible personnel 6.5.10 Do coding techniques address broken authentication Examine software-development and session management? policies and procedures Note: Requirement 6.5.10 is a best practice until June Interview responsible personnel 30, 2015, after which it becomes a requirement.
For web applications and application interfaces (internal or external), are applications developed based on secure coding guidelines to protect applications from the following additional vulnerabilities: 6.5.7 Do coding techniques address cross-site scripting (XSS) vulnerabilities? Examine software-development policies and procedures Interview responsible personnel 6.5.8 Do coding techniques address improper access control such as insecure direct object references, failure to restrict URL access, directory traversal, and failure to restrict user access to functions? Examine software-development policies and procedures Interview responsible personnel 6.5.9 Do coding techniques address cross-site request forgery (CSRF)? Examine software-development policies and procedures Interview responsible personnel 6.5.10 Do coding techniques address broken authentication and session management? Note: Requirement 6.5.10 is a best practice until June 30, 2015, after which it becomes a requirement. Examine software-development policies and procedures Interview responsible personnel
SAQ_A-EP_v3.docx