Veracode for PCI Compliance

Veracode helps organizations meet the application security and code review requirements of the PCI standard. As an expert in application security, Veracode is in a unique position to provide an independent assessment, standards-based rating and secure coding training to ensure your applications comply with PCI DSS and PCI PA-DSS. Unlike costly and labor intensive manual code analysis, Veracode’s cloud-based service allows you to automate application reviews and receive results within 24-72 hours. This revolutionary approach means you can simplify your compliance efforts by using a single provider for all your PCI application security and secure development training needs.

PCI Compliance for Merchants and Service Providers

According to research by Gartner and Symantec, close to 90 percent of software attacks are aimed at the application layer. Thus, it comes as no surprise that the PCI DSS has made application security one of its cornerstones. Requirements 6.3.7, 6.5 and 6.6 identify specific steps in secure application development and deployment which organizations must meet in order to achieve PCI compliance. PCI DSS requires independent code reviews to identify software vulnerabilities and secure coding training to ensure developers know how to write secure software.

PCI Compliance for Payment Software Vendors

Visa Payment Application Best Practices (PABP) standard applies to software vendors who develop payment applications that store, process, or transmit cardholder data as part of authorization or settlement. PCI has adopted Visa’s PABP and released a new standard called the Payment Application Data Security Standard (PA-DSS). Payment Software Vendors will need to certify their products to PA-DSS and demonstrate that their application code has undergone vulnerability analysis per the requirements specified in section 5. Visa mandates that only certified payment software can be used for new deployments.


Business Requirement Veracode Solution

Require clear and concise analysis of vulnerabilities that provide a measurable risk rating against a known standard

Standards-Based Ratings - Veracode combines MITRE’s Common Weakness Enumeration (CWE) for classification of software weaknesses and FIRST’s Common Vulnerability Scoring System (CVSS) which provides a practical way to assess application security and risk

Custom application code must be reviewed by an organization that specializes in application security

Independent & Trusted Review – Veracode meets the PCI definition of an organization specializing in application security. The Veracode team has deep security and industry expertise from industry-leading security and services companies such as @stake, Symantec, Guardent, VeriSign and

Develop a process for periodic custom application code review on a consistent basis and re-evaluate application code after corrections or changes are made

Automated Scanning - Allows organizations to schedule application and remediation reviews on-line without the need to re-engage consultants who manually review lines of code

Simplify application code review processes across multiple applications and dispersed development teams

Deploy Rapidly & Globally - Veracode provides a single web portal for teams to centrally collaborate on disparate projects with executive rollup dashboards to gauge overall status

Meet PCI requirements for outsourced or 3rd party custom applications where source code is not available

Integrated gray-box testing - Veracode is the only vendor that integrates both dynamic and static binary code analysis without requiring access to source code

Reduce the cost associated with specialized consultants who manually review application code

Security Expertise without High Costs – Veracode provides industry-leading security expertise without the high costs of manual reviews or investment in software and other