Key Project Information:OWASP PCI Project

=Main=



{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 * valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

OWASP PCI Toolkit
OWASP PCI toolkit is an Open Source c# Windows form project, that will help you to scope the PCI-DSS requirements for your System Components. Beta version of this tool will be released May 2014

Introduction
The PCI toolkit is based on a decision tree assessment methodology, to help you define if your web applications are part of the PCI-DSS scope and within the PCI-DSS requirements. By decomposing, one by one , you will be able to create an assessment and a final report of your scope delimitation and which OWASP guidelines must be used

Licensing
OWASP PCI Toolkit is free to use. It is licensed under the Creative Commons Attribution-ShareAlike 3.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

Presentation
https://www.owasp.org/index.php/File:Pci-dss.pdf

Project Leader(s)
Johanna Curiel Ignacio Salom

Related Projects

 * OWASP Secure Coding Practices - Quick Reference Guide
 * OWASP Application Security Verification Standard

Repository
https://github.com/owaspjocur/OwaspPciToolkit

Reference Files

 * OWASP SCP requirements
 * OWASP ASVS verification IDs
 * OWASP AppSensor attack detection point IDs
 * CAPEC IDs
 * SAFECode security-focused story IDs

The OWASP SCP does not include identity values for the requirements, so please use.

News and Events
A presentation of the tool will be given at APPSEC EU 2014 For more info visit: https://www.owasp.org/index.php/OWASP_Project_Summit_2014/Home#tab=Tracks_and_Sessions

PCIDSS


OWASP Cornucopia Ecommerce Website Edition is referenced in the new Payment Card Industry Security Standards Council information supplement PCI DSS E-commerce Guidelines v2, January 2013

Classifications

 * }

= How to =

Understanding of security vulnerabilities and the OWASP top ten is essential for using properly this scoping tool. The tool helps you identify if the application falls within the PCI-DSS scope in order to become compliant however it is essential to identify if your organization has the necessary tools and know-how to be able to create a scope -Knowledge of the OWASP top ten -Knowledge of penetration tests and tools as advised by the PCI security council (ASV vendors)

=FAQs=

What is PCI-DSS?

The PCI Security Standards Council offers robust and comprehensive standards and supporting materials to enhance payment card data security. These materials include a framework of specifications, tools, measurements and support resources to help organizations ensure the safe handling of cardholder information at every step. The keystone is the PCI Data Security Standard (PCI DSS), which provides an actionable framework for developing a robust payment card data security process -- including prevention, detection and appropriate reaction to security incidents.

= Acknowledgements =

Others
= Road Map and Getting Involved =

A prototype of the tool will be released in May 2014 -Beta version 1.0 This beta version provides the following features Series of Questions and answers regarding the Web application to be analyzed -Card Holder Data present -Analysis of Development Environment process and procedures -Analysis of Testing Environment process and procedures