PCI DSS 6.5.8 addresses which security issue?

PCI DSS 6.5.8 addresses which security issue?

• A. Insecure cryptographic storage
• B. Cross-site scripting (XSS)
• C. Insecure communications
• D. Improper access control (such as insecure direct object references, failure to restrict URL access, directory traversal, and failure to restrict user access to functions)

Answer: (D)

The main idea tested here is that web applications must enforce proper access control to prevent unauthorized access to data or functionality. PCI DSS 6.5.8 specifically targets weaknesses in that area, listing issues like insecure direct object references (where a user can manipulate a parameter to access another person’s data), failure to restrict URL access, directory traversal, and insufficient restrictions on who can perform certain functions. These flaws let an attacker bypass authorization and reach resources or perform actions they shouldn’t, so the focus is on implementing strong authorization checks on every request, not exposing direct resource references, and restricting both URL access and function access according to user permissions. Other issues like insecure cryptographic storage, cross-site scripting, and insecure communications are important but fall under different controls: protecting stored cardholder data, preventing injection-type web vulnerabilities, and ensuring data protection in transit, respectively.

The main idea tested here is that web applications must enforce proper access control to prevent unauthorized access to data or functionality. PCI DSS 6.5.8 specifically targets weaknesses in that area, listing issues like insecure direct object references (where a user can manipulate a parameter to access another person’s data), failure to restrict URL access, directory traversal, and insufficient restrictions on who can perform certain functions. These flaws let an attacker bypass authorization and reach resources or perform actions they shouldn’t, so the focus is on implementing strong authorization checks on every request, not exposing direct resource references, and restricting both URL access and function access according to user permissions.

Other issues like insecure cryptographic storage, cross-site scripting, and insecure communications are important but fall under different controls: protecting stored cardholder data, preventing injection-type web vulnerabilities, and ensuring data protection in transit, respectively.