etc.) V5.19 Verify that for each type of output encoding/escaping performed by the application, is a single security control for that type of output for the intended destination. V7: Cryptography at Rest Verification Requirements The table below defines the corresponding verification requirements that apply for each of the verification levels. Verification requirements for Level 0 are not defined by this standard. CRYPTOGRAPHY AT REST VERIFICATION REQUIREMENT LEVELS 1 2 3 V7.1 Verify that all cryptographic functions used to protect secrets from the application user are implemented server side. V7.2 Verify that all cryptographic modules fail securely. V7.3 Verify that access to any master secret(s) is protected from unauthorized access (A master secret is an application credential stored as plaintext on disk that is used to protect access to security configuration information). V7.6 Verify that all random numbers, random file names, random GUIDs, and random strings are generated using the cryptographic module’s approved random number generator when these random values are intended to be unguessable by an attacker.
V8.4 Verify that error handling logic in security controls denies access by default. V8.5 Verify security logging controls provide the ability to log both success and failure events that are identified as security-relevant. V8.6 Verify that each log event includes: a timestamp from a reliable source, severity level of the event, an indication that this is a security relevant event (if mixed with other logs), the identity of the user that caused the event (if there is a user associated with the event), the source IP address of the request associated with the event, whether the event succeeded or failed, and a description of the event. V8.7 Verify that all events that include untrusted data will not execute as code in the intended log viewing software. V8.8 Verify that security logs are protected from unauthorized access and modification. V8.9 Verify that there is a single application-level logging implementation that is used by the software. V8.10 Verify that the application does not log application-specific sensitive data that assist an attacker, including user’s session identifiers and personal or sensitive information. The length and existence of sensitive data can be logged. V8.11 Verify that a log analysis tool is available which allows the analyst to search for log events based on combinations of search criteria across all fields in the log record format supported by this system. V8.13 Verify that all non-printable symbols and field separators are properly encoded in log entries, to prevent log injection. V8.14 Verify that log fields from trusted and untrusted sources are distinguishable in log entries. V8.15 Verify that logging is performed before executing the transaction. If logging was unsuccessful (e.g. disk full, insufficient permissions) the application safe. This is for when integrity and non-repudiation are a must.
Retail, Food, Hospitality Many of the attackers in this segment utilize opportunistic "smash and grab" tactics. However, there is also a regular threat of specific attacks on applications known to contain payment information, perform financial transactions, or store personally identifiable information. Although less likely than the threats mentioned above, there is also the possibility of more advanced threats attacking this industry segment to steal intellectual property, gain competitive intelligence, or gain an advantage with the target organization or a business partner in negotiations. Level 1: all Internet-accessible applications. Level 2: Suitable for business applications, product catalogue information, internal corporate information, and applications with limited user information (e.g. contact information). Applications with small or moderate amounts of payment data or checkout functionality. Level 3: Payment and Point of Sale systems (POS) that contain large amounts of transaction data that could be used to commit fraud. This includes any administrative interfaces for these applications. Applications with a large volume of sensitive information like full credit card numbers, mother's maiden name, social security numbers etc.