--- title: Considerations for PA-DSS Compliant Solution Development - Part 2 description: Considerations for PA-DSS Compliant Solution Development - Part 2 --- [![e-Zest logo\_An accion lab company\_Colour](https://blog.e-zest.com/hubfs/images/Logos%20with%20Tagline/Corporate/SVG/e-Zest%20logo_An%20accion%20lab%20company_Colour.svg "e-Zest logo_An accion lab company_Colour")](https://www.e-zest.com/) - [WORK](https://www.e-zest.com/our-work) - [SERVICES](https://www.e-zest.com/our-services) - [Product Engineering](https://www.e-zest.com/digital-product-engineering-services) - [Enterprise Data Services](https://www.e-zest.com/enterprise-data-services) - [Digital Commerce](https://www.e-zest.com/digital-commerce-services) - [Digital Operations](https://www.e-zest.com/digital-operations) - [Digital Consulting](https://www.e-zest.com/digital-transformation-consulting-services) - [Digital Experience Design](https://www.e-zest.com/digital-experience-design) - [INSIGHTS](https://blog.e-zest.com/) - [CAREERS](https://www.e-zest.com/careers) - [ENTERPRISE DATA SERVICES](https://www.e-zest.com/enterprise-data-services) - [GENERATIVE AI](https://www.e-zest.com/generative-ai) - [Healthcare](https://healthcare.e-zest.com) - [Contact Us](https://www.e-zest.com/contact-us) - ![Elevating Product Engineering with AI and ML](https://blog.e-zest.com/hubfs/Elevating%20Product%20Engineering%20with%20AI%20and%20ML.jpg) [BLOGS](https://blog.e-zest.com) #### Elevating Product Engineering with AI and ML As technology evolves and customer choices broaden, there is an increasing ... [Read more](https://blog.e-zest.com/elevating-product-engineering-with-ai-and-ml) - ![e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024](https://blog.e-zest.com/hubfs/e-Zest%20%E2%80%93%20An%20Accion%20Labs%20Company%20-%20Gets%20Recognition%20as%20a%20Contender%20in%20the%20ISG%20Provider%20LensTM%20Study%20on%20Digital%20Engineering%20Services%202024.jpg) [NEWS](https://blog.e-zest.com/news) #### e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024 We are delighted to announce that e-Zest – An Accion Labs Company has been ... [Read more](https://blog.e-zest.com/news/e-zest-an-accion-labs-company-gets-recognition-as-a-contender-in-the-isg-provider-lens-study-on-digital-engineering-services-2024) - ![e-Zest Solutions supports Digital Pune Mission](https://blog.e-zest.com/hubfs/blog-files/Digital%20Literacy%20Bus%20e-Zest.png) [CSR](https://blog.e-zest.com/csr) #### e-Zest Solutions supports Digital Pune Mission **Pune, India:** e-Zest Solutions, a leading digital technology innovation ... [Read more](https://blog.e-zest.com/csr/e-zest-solutions-supports-digital-pune-mission) - [Work](https://www.e-zest.com/our-work) - [Services](https://www.e-zest.com/our-services) - [Insights](https://blog.e-zest.com) - [Careers](https://www.e-zest.com/careers) - [Enterprise Data](https://www.e-zest.com/enterprise-data-services) - [Generative AI](https://www.e-zest.com/generative-ai) - [Innovations](https://www.e-zest.com/innovations) - [Healthcare](https://healthcare.e-zest.com) - [About](https://www.e-zest.com/about-us) - [Contact](https://www.e-zest.com/contact-us) - [Blog](https://blog.e-zest.com/) - [News](https://blog.e-zest.com/news) - [CSR](https://blog.e-zest.com/csr) - [![Linkedin Icon](https://blog.e-zest.com/hubfs/icons/linkedin_icon_white.svg)](https://www.linkedin.com/company/e-zest-solutions/) - [![Twitter Icon](https://blog.e-zest.com/hubfs/twitter-logo-silhouette%20(5).svg)](https://twitter.com/ezest) - [![Facebook Icon](https://blog.e-zest.com/hubfs/facebook-app-logo%20(4).svg)](https://www.facebook.com/61259256638) - [![Instagram Icon](https://blog.e-zest.com/hubfs/instagram-logo%20(4).svg)](https://www.instagram.com/ezestsolutions/) - [![Youtube Icon](https://blog.e-zest.com/hubfs/icons/youtube_icon_white.svg)](https://www.youtube.com/user/ezestcorporate) [![Go to top icon](https://blog.e-zest.com/hubfs/AA%20Assets/top%20button.svg)](https://blog.e-zest.com/considerations-for-pa-dss-compliant-solution-development-part-2/#top) Hit enter to search or ESC to close Insights e-Zest members share technology ideas to foster digital transformation. - [Blog](https://blog.e-zest.com) - [News](https://blog.e-zest.com/news) - [Podcasts](https://www.e-zest.com/podcasts) - [Healthcare](https://blog.e-zest.com/healthcare) - [CSR](https://blog.e-zest.com/csr) - [Whitepaper](https://blog.e-zest.com/whitepaper) - [Playbook](https://blog.e-zest.com/playbook) - [Media Kit](https://www.e-zest.com/media-kit) # Considerations for PA-DSS Compliant Solution Development - Part 2 [Lalit Kale](https://blog.e-zest.com/author/lalit-kale) May 10, 2012 [Solution Development](https://blog.e-zest.com/topic/solution-development) [PA-DSS Compliant](https://blog.e-zest.com/topic/pa-dss-compliant) [Technology](https://blog.e-zest.com/topic/technology) - - - - For earlier 9 points kindly refer to my earlier blog at [Considerations for PA-DSS Compliant Solution Development – Part 1](https://blog.e-zest.com/blog/considerations-for-pa-dss-compliant-solution-development-part-1/) 1. Develop applications based on secure coding guidelines. Prevent common coding vulnerabilities in software development processes, to include the following: a. Documentation of impact: document the impact of change in code or customization of software. b. Documented change approval by authorized parties. c. Functionality testing to verify that the change does not adversely impact the security of the system. d. Back out Procedures 2. Testing should be done to avoid any flaws like SQL injection. Also consider OS Command Injection, LDAP and XPath injection flaws, Buffer overflows, cross site scripting attacks and cross site request forgery (CSRF). 3. Develop all web applications based on secure coding guidelines such as the Open Web Application Security Project guidelines. Review custom application code to identify coding vulnerabilities. Cover prevention of common coding vulnerabilities in software development processes, to include the following: - Un-validated input - Broken access control (for example, malicious use of user IDs) - Broken authentication and session management (use of account credentials and session cookies) - Cross-site scripting (XSS) attacks - Buffer overflows - Injection flaws (for example, structured query language (SQL) injection) - Improper error handling - Insecure storage (cryptographic or otherwise) - Denial of service - Security Misconfiguration - Insecure Direct Object References - Cross-Site Request Forgery (CSRF) - Failure to Restrict URL Access - Insufficient Transport Layer Protection - Unvalidated Redirects and Forwards 4. SSL protects data that is transmitted between a browser and web server. It is critical that you have SSL enabled on the web server, and this should be among the first steps taken after installation. - Web server must be configured to use SSL v3 or TLS v1 protocols with strong encryption (128-bit or longer key is required) - Install SSL certificate issued for specified web domain. 5. PCI compliance requires that you use unique user names and secure authentication to access any PCs, servers, and databases with payment applications and/or cardholder data. This means that you should use different user names/passwords: a. For your Web hosting account administration area (Web hosting account where your online store is hosted) b. For FTP access to the Web server c. For Remote Desktop Connection to the Web server (if available) d. To connect to the MySQL server that contains your store data. 6. Audit trails Audit trails/logs are should be automatically enabled with the default installation of software solution. There should be no option to disable audit logging. The following types of activity should be logged: a. All actions taken by any individual with root or administrative privileges b. Initialization of the audit logs c. User sign in and sign out. Individual access to cardholder data is not logged, because cardholder data is not stored before and after authentication. Access to audit trails must be provided on the operating system level. Each log event includes: 1\. Type of event 2\. Date and time of event 3\. Username and IP address 4\. Success or failure indication 5\. Action which led to the event 6\. Component which led to the event 7. Wireless communications a. If you use wireless networking to access software, it is your responsibility to ensure your wireless security con figuration follows the PCI DSS requirements. b. Personal firewall software should be installed on any mobile and employee-owned computers that have direct access to the internet and are also used to access your network. c. Change wireless vendor defaults, including but not limited to, wired equivalent privacy (WEP) keys, default service set identifier (SSID), passwords and SNMP community strings. Disable SSID broadcasts. Enable WiFi protected access (WPA and WPA2) technology for encryption and authentication when WPA-capable. d. Encrypt wireless transmissions by using WiFi protected access (WPA or WPA2) technology, IPSEC VPN, or SSL/TLS. e. Never rely exclusively on wired equivalent privacy (WEP) to protect confidentiality and access to a wireless LAN. If WEP is used, do the following: f. Use with a minimum 104-bit encryption key and 24 bit-initialization value g. Use ONLY in conjunction with WiFi protected access (WPA or WPA2) technology, VPN, or SSL/TLS h. Rotate shared WEP keys quarterly (or automatically if the technology permits) i. Rotate shared WEP keys whenever there are changes in personnel with access to keys j. Restrict access based on media access cod e (MAC) address. k. Install perimeter firewalls between any wireless networks and the cardholder data environment, and configure these firewalls to deny any traffic from the wireless environment or to control any traffic if it is necessary for business purposes. 8. Remote access Software provides web-based access using two-factor authentication based on one-time PIN codes. a. If you enable remote access to your network and the cardholder data environment, you must implement two-factor authentication. Use technologies such as remote authentication and dial-in service (RADIUS) or terminal access controller access control system (TACACS) with tokens; or VPN (based on SSL/TLS or IPSEC) with individual certificates. You should make sure that any remote access software is securely configured by keeping in mind the following: b. Change default settings in the remote access software (for example, change default passwords and use unique passwords for each customer) c. Allow connections only from specific (known) IP/MAC addresses d. Use strong authentication or complex passwords for logins e. Enable encrypted data transmission f. Enable account lockout after a certain number of failed login attempts g. Configure the system so a remote user must establish a Virtual Private Network (“VPN”) connection via a firewall before access is allowed h. Enable any logging or auditing functions i. Restrict access to customer passwords to authorized reseller/integrator personnel j. Retain audit trail history for at least one year, with a minimum of three months immediately available for analysis (for example, online, archived, or restorable from backup). - - - ### Similar Blog [![Considerations for PA-DSS Compliant Solution Development - Part 1](https://blog.e-zest.com/hs-fs/file-3443236272-png/blog-files/pci.png) Considerations for PA-DSS Compliant Solution Development - Part 1 Following are the considerations for the development and Implementation of software solutions in a PCI-DSS Compliant Environment. ... By Lalit Kale May 04, 2012](https://blog.e-zest.com/considerations-for-pa-dss-compliant-solution-development-part-1/) [Introduction to Specification Pattern](https://blog.e-zest.com/introduction-to-specification-pattern/) [Specification pattern has emerged out of “Domain Driven Design” phenomenon. It is first identified and articulated](https://blog.e-zest.com/introduction-to-specification-pattern/)[here](http://martinfowler.com/apsupp/spec.pdf) by Eric ... By Lalit Kale Jun 20, 2012 [![Considerations for PA-DSS Compliant Solution Development - Part 1](https://blog.e-zest.com/hs-fs/file-3443236272-png/blog-files/pci.png) Considerations for PA-DSS Compliant Solution Development - Part 1 Following are the considerations for the development and Implementation of software solutions in a PCI-DSS Compliant Environment. ... By Lalit Kale May 04, 2012](https://blog.e-zest.com/considerations-for-pa-dss-compliant-solution-development-part-1/) [PCI Compliance Overview PCI DSS version 2.0 must be adopted by all organizations with payment card data by 1 January 2011, and from 1 January 2012 all ... By Lalit Kale Apr 30, 2012](https://blog.e-zest.com/pci-compliance-overview/) [PCI Compliance Introduction The Payment Card Industry (PCI) has developed security standards for handling cardholder information in a published standard ... By Lalit Kale Apr 25, 2012](https://blog.e-zest.com/pci-compliance-introduction/) ## Helping Organizations Thrive in the Digital Age [Contact Us](https://www.e-zest.com/contact-us) - [About](https://www.e-zest.com/about-us) - [Services](https://www.e-zest.com/our-services) - [Work](https://www.e-zest.com/our-work) - [Insights](https://blog.e-zest.com/) - [Healthcare](https://healthcare.e-zest.com/) - [Accion Labs](https://www.accionlabs.com/) - - - - - - Dallas - Detroit - Hannover - Vienna - London - Pune © 2025 e-Zest Solutions - [Privacy Policy](https://www.e-zest.com/privacypolicy) - [Cookie Policy](https://www.e-zest.com/cookie-policy) Contact us Contact us e-Zest is a leading digital innovation partner for enterprises and technology companies that utilizes emerging technologies for creating engaging customers experiences. Being a customer-focused and technology-driven company, it always helps clients in crafting holistic business value for their software development efforts. It offers software development and consulting services for cloud computing, enterprise mobility, big data and analytics, user experience and digital commerce.