3 ms·

The majority of those scripts are version controlled already. They're explicitly using V1.0.3 or whatever. So responsible site owners are already testing and a

• numbsafari 8y ago
  Indeed, to comply with PCI-DSS v3.2.1, requirement 6.1 you must "Establish a process to identify security vulnerabilities, using reputable outside sources for security vulnerability information", and requirement 6.2 you must "Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor supplied security patches." So you need to have an inventory of all vendor supplied software and hardware, monitor for security advisories from those vendors, and have an adequate change management process to respond to those advisories in a timely fashion. All of that needs to be auditable.
• seanwilson 8y ago
  > So responsible site owners are already testing and approving version changes. I'm not saying it's not possible, I'm asking how it could be made easier and for sites in general, not just payment websites. The more resources something takes, the less developers that are going to do it so the web will be less secure.