{"id":253,"date":"2020-04-07T16:39:06","date_gmt":"2020-04-07T16:39:06","guid":{"rendered":"http:\/\/www.pcidssguide.com\/?p=253"},"modified":"2023-10-09T07:46:45","modified_gmt":"2023-10-09T07:46:45","slug":"pci-dss-requirement-6","status":"publish","type":"post","link":"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/","title":{"rendered":"PCI DSS Requirement 6 Explained"},"content":{"rendered":"\n\n\n\n\n<h2 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6: Develop and maintain secure systems and applications<\/strong><\/h2>\n\n\n\n<p>Malicious people are exploiting vulnerabilities to gain privileged access to systems. Most of these vulnerabilities may be addressed by people who manage the systems or by security patches provided by the manufacturers.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/pci-web-application-security-requirements\/\">See Also: PCI Web Application Security Requirements<\/a><\/strong><\/p>\n\n\n\n<p>All systems must have all appropriate software patches to protect against misuse and compromise of cardholder data by malicious individuals and malicious software.<\/p>\n\n\n\n<p>Appropriate software patches are patches that have been properly evaluated and tested to determine that patches do not conflict with current security configurations. A large number of vulnerabilities can be avoided by using standard system development processes and secure coding techniques for in-house applications.<\/p>\n\n\n\n<p>PCI DSS Requirement 6 deals with the development of secure applications and systems. It aims to properly manage security patches and secure system and application configurations to ensure continued protection against misuse or compromise of cardholder data.<\/p>\n\n\n\n<p>Let\u2019s take a look at all the sub-requirements found in PCI DSS requirement 6.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.1: Establish a process to identify vulnerabilities using reputable outside sources and assign a risk ranking to newly discovered vulnerabilities.<\/strong><\/h2>\n\n\n\n<p>The purpose of this requirement is to make organizations aware of new vulnerabilities that could affect their environment. Vulnerability information sources must be reliable and can often be obtained from sources such as manufacturer\u2019s websites, industry newsgroups, mailing lists, or RSS feeds.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/patching-for-complying-with-pci-dss-requirement-6\/\">See Also: Patching for Complying with PCI DSS Requirement 6<\/a><\/strong><\/p>\n\n\n\n<p>When an organization identifies a vulnerability that could affect its environment, the vulnerability risk must be assessed and rated. For this reason, the organization must have a method for continuously assessing and assigning risk rankings to vulnerabilities.<\/p>\n\n\n\n<p>However, this method cannot be achieved with an ASV scan or internal network vulnerability scan. Instead, it is necessary to monitor industry resources for vulnerability information actively.<\/p>\n\n\n\n<p>Classifying risks as \u201chigh\u201d, \u201cmedium\u201d or \u201clow\u201d allows organizations to identify, prioritize and address the highest risk vulnerabilities faster. In this way, attackers are less likely to exploit security vulnerabilities that pose the greatest risk.<\/p>\n\n\n\n<p>The risk rankings should be based on industry best practices and consideration of the potential impact. For example, criteria for rating vulnerabilities may include taking into account the type of CVSS baseline or manufacturer classification and systems affected.<\/p>\n\n\n\n<p>Methods for assessing vulnerabilities and assigning risk ratings can vary depending on an organization\u2019s environment and risk assessment strategy. The risk ranking should at least describe all vulnerabilities that are considered \u201chigh risk\u201d to the environment.<\/p>\n\n\n\n<p>In addition to the risk rating, vulnerabilities can be considered \u201ccritical\u201d if they pose a high threat to the environment, affect critical systems, or cause a potential compromise if not addressed.<\/p>\n\n\n\n<p>Examples of critical systems may include security systems, public devices and systems, databases, and other systems that store, process or transmit cardholder data.<\/p>\n\n\n\n<p>The process to identify vulnerabilities and assign risk rankings to vulnerabilities should include the following items:<\/p>\n\n\n\n<ul>\n<li>New security vulnerabilities should be identified.<\/li>\n\n\n\n<li>A risk ranking should be assigned that includes identification of all \u201chigh risk\u201d and \u201ccritical\u201d vulnerabilities.<\/li>\n\n\n\n<li>Processes to identify new vulnerabilities should include using reputable outside sources for vulnerability information.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.2: Ensure that all system components and software are protected from known vulnerabilities by installing the applicable security patches provided by the manufacturer. Install critical security patches within a month.<\/strong><\/h2>\n\n\n\n<p>There is a constant stream of attacks against otherwise secured systems that exploit widely published vulnerabilities, often referred to as a \u201czero-day\u201d or an attack that exploits a previously unknown vulnerability.<\/p>\n\n\n\n<p>The latest patches should be applied to critical systems as soon as possible. If critical patches are not applied in time, a malicious person could exploit these vulnerabilities to attack or disable a system or access sensitive data.<\/p>\n\n\n\n<p>Prioritizing patches for critical infrastructures ensures that high priority systems and devices are protected from vulnerabilities as soon as a patch is released.<\/p>\n\n\n\n<p>Critical or risky systems require the installation of critical or high-risk security patches within 30 days and other low-risk patches within 2-3 months.<\/p>\n\n\n\n<p>This requirement applies to patches that apply to all installed software, including payment applications.<\/p>\n\n\n\n<p>Critical security patches should be identified by the risk ranking process defined in PCI DSS Requirement 6.1.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.3: Develop internal and external software applications securely.<\/strong><\/h2>\n\n\n\n<p>Security should be included in the definition, design, analysis and testing phases of the software development process. If security controls are not added to software development processes, vulnerabilities may be included unintentionally or maliciously in the live environment.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/what-does-pci-compliant-software-development-mean-for-developers\/\">See Also: What Does PCI Compliant Software Development Mean for Developers<\/a><\/strong> <\/p>\n\n\n\n<p>Understanding how sensitive data is processed by the application (when it is stored, when it is transmitted, and when it remains in memory) will help determine where the data should be protected.<\/p>\n\n\n\n<p>Internal and external software applications should be developed securely, and the following items should be addressed in secure software development procedures:<\/p>\n\n\n\n<ul>\n<li>The software must be developed by PCI DSS requirements. (For example, secure authentication and logging)<\/li>\n\n\n\n<li>Must be based on industry standards or best practices.<\/li>\n\n\n\n<li>Information security must be included throughout the software development lifecycle.<\/li>\n<\/ul>\n\n\n\n<p>It should be noted that this requirement applies to all software developed internally as well as to custom software developed by third parties.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.3.1: Remove development, test or custom application accounts, user IDs, and passwords before applications become active or available to customers.<\/strong><\/h3>\n\n\n\n<p>Development, test or custom app accounts, user IDs, and passwords must be removed via live code before the app becomes active or available to customers because these items can give important information about the operation of the application to malicious people. Having such important information can make it easier to compromise the app and associated cardholder data.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.3.2: Perform code reviews before applications are become active or released to customers to identify possible coding vulnerabilities.<\/strong><\/h3>\n\n\n\n<p>Vulnerabilities in private code are commonly used by malicious actors to gain access to a network and compromise cardholder data.<\/p>\n\n\n\n<p> <strong><a href=\"https:\/\/pcidssguide.com\/how-to-perform-code-reviews-for-pci-requirements\/\">See Also: How to Perform Code Reviews for PCI Requirements<\/a><\/strong><\/p>\n\n\n\n<p>The review process should involve a person who is knowledgeable and experienced in code review techniques. Code reviews should be carried out by someone other than the code developer to allow an independent and objective review.<\/p>\n\n\n\n<p>Automated tools or processes can also be used for code reviews instead of manual reviews. Still, it should be noted that an automated tool can be difficult or even impossible to identify some coding issues.<\/p>\n\n\n\n<p>Correcting coding errors before a live code is deployed or made available to customers prevents the code from exposing environments to potential abuse. Bad code is much more difficult and expensive to fix after it is deployed or released in production environments.<\/p>\n\n\n\n<p>The management should establish a formal review and approval process before the code is published. Having a formal approval process helps ensure that the code is approved and developed by the procedures.<\/p>\n\n\n\n<p>This code review requirement applies to all custom code as part of the system development lifecycle. Code reviews may be carried out by knowledgeable internal personnel or third parties.<\/p>\n\n\n\n<p>Code reviews should include the following items:<\/p>\n\n\n\n<ul>\n<li>Code changes should be reviewed by people other than the source code author and those who are familiar with code review techniques and secure coding practices.<\/li>\n\n\n\n<li>Code reviews should ensure that the code is developed by safe coding guidelines.<\/li>\n\n\n\n<li>Corrections with relevant results should be applied before the code is published.<\/li>\n\n\n\n<li>Code review results should be reviewed and approved by management before they are published.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.4: Follow change control processes and procedures for all changes to system components.<\/strong><\/h2>\n\n\n\n<p>Without properly documented and enforced change controls, security features can be deliberately or unintentionally neglected or rendered inoperable, transactional irregularities, or malicious code.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/change-control-management-for-pci-dss\/\">See Also: Change Control Management for PCI DSS<\/a><\/strong><\/p>\n\n\n\n<p>Change control processes and procedures should include the following:<\/p>\n\n\n\n<ul>\n<li>Development\/test environments must be separate from production environments with access control.<\/li>\n\n\n\n<li>Duties should be separated between the staff assigned to the development\/test environments and the staff assigned to the live environment.<\/li>\n\n\n\n<li>Production data (live PANs) should not be used for testing or development purposes.<\/li>\n\n\n\n<li>Test data and accounts must be removed before a production system can be activated.<\/li>\n\n\n\n<li>Change control procedures should be documented for implementing security patches and changes to the software.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.4.1: Separate development and test environments from live environments and implement separation with access controls.<\/strong><\/h3>\n\n\n\n<p>Ever-changing development and test environments tend to be less secure than live environments. If there is insufficient separation between environments, it may be possible for the live environment and cardholder data to be compromised due to fewer security configurations and possible vulnerabilities.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.4.2: Separation of duties between development, testing and live environments is required.<\/strong><\/h3>\n\n\n\n<p>Reducing the number of staff with access to live media and cardholder data minimizes risk and helps ensure that access is limited to those with a business need to know.<\/p>\n\n\n\n<p>The purpose of this requirement is to separate the development and test functions from the production functions. For example, a developer can use an administrator-level account with elevated privileges in the development environment and have a separate account with user-level access to the production environment.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/what-is-the-separation-of-duties-principle-how-is-it-implemented\/\">See Also: What is the Separation of Duties Principle and How Is It Implemented?<\/a><\/strong><\/p>\n\n\n\n<p>In environments where an employee takes on multiple roles, tasks should be assigned so that no one has end-to-end control of a process that does not have an independent control mechanism. For example, responsibility for the development, authorization, and monitoring functions can be delegated to separate individuals.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.4.3: Production data (live PANs) are not used for testing or development.<\/strong><\/h3>\n\n\n\n<p>Security controls are generally not that strict in test or development environments. The use of production data in such environments provides malicious individuals with the opportunity to gain unauthorized access to production data (cardholder data).<\/p>\n\n\n\n<p>Payment card brands and many buyers can often provide appropriate account numbers for this purpose if realistic PANs are needed to test system functionality.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.4.4: Test data and accounts must be removed from system components before the system is enabled before going live.<\/strong><\/h3>\n\n\n\n<p>Test data and accounts must be removed before the system component becomes active because these items can provide various important information about the functioning of the application or system. The fact that malicious people have such information can make it easier to compromise the system and related cardholder data.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.4.5: Change control procedures should include the following:<\/strong><\/h3>\n\n\n\n<p>Suppose change control procedures are not properly managed. In that case, the impact of system changes such as hardware or software updates and the installation of security patches may go unnoticed and have unintended consequences.<\/p>\n\n\n\n<p>Therefore, documented change control procedures should be established and include the following items:<\/p>\n\n\n\n<ul>\n<li>Impact analysis documentation<\/li>\n\n\n\n<li>Documented change approval by authorized parties<\/li>\n\n\n\n<li>Functionality testing to verify that the change does not adversely affect the security of the system<\/li>\n\n\n\n<li>Back-out procedures<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.4.5.1: Document the impact of the change.<\/strong><\/h3>\n\n\n\n<p>The impact of the change must be documented so that all affected parties can properly plan for any changes. In this way, a smooth process can be created by analyzing the possible effect of the change in advance.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/what-are-the-impact-analysis-requirements-for-pci-dss-compliance\/\">See Also: What Are the Impact Analysis Requirements for PCI DSS Compliance<\/a><\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.4.5.2: Changes require documented change approval by authorized parties.<\/strong><\/h3>\n\n\n\n<p>The approval given by the authorized parties indicates that the change is legitimate and approved by the organization.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.4.5.3: Perform functionality test to verify that the change does not adversely affect the security of the system.<\/strong><\/h3>\n\n\n\n<p>Extensive testing should be done to verify that the security of the environment is not compromised by implementing a change. The test should verify that all existing security controls remain in place, are replaced with equally robust controls, or strengthened after any changes have been made to the environment.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.4.5.4: Establish back-out procedures for changes.<\/strong><\/h3>\n\n\n\n<p>For each change, there should be documented rollback procedures to allow the system to revert to its previous state if the change fails or adversely affects the security of an application or system.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.4.6: After a significant change is complete, all relevant PCI DSS requirements should be applied to all new or modified systems and networks, and documentation updated accordingly.<\/strong><\/h3>\n\n\n\n<p>The use of mechanisms that evaluate significant changes helps ensure that all relevant PCI DSS controls are applied to all devices or networks implemented or modified in the covered environment.<\/p>\n\n\n\n<p>Establishing this verification in change management processes helps ensure that device inventories and configuration standards are kept up to date, and security controls are enforced when necessary.<\/p>\n\n\n\n<p>The change management process should include supporting evidence that PCI DSS requirements are implemented or maintained through the iterative process.<\/p>\n\n\n\n<p>Examples of PCI DSS requirements that may be affected include the following:<\/p>\n\n\n\n<ul>\n<li>The network diagram should be updated to reflect the changes.<\/li>\n\n\n\n<li>Systems should be configured according to configuration standards by changing all default passwords and disabling unnecessary services.<\/li>\n\n\n\n<li>Systems must be protected with necessary controls. Examples of controls include file integrity monitoring (FIM), anti-virus, patches, audit logging.<\/li>\n\n\n\n<li>Sensitive authentication data (SAD) should not be stored, and the storage of all cardholder data (CHD) should be documented and included in data collection policy and procedures.<\/li>\n\n\n\n<li>New systems should be included in the quarterly vulnerability scanning process.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.5: Address common coding vulnerabilities in software development processes.<\/strong><\/h2>\n\n\n\n<p>The application layer carries a high risk and can be targeted by both internal and external threats. Requirements 6.5.1 through 6.5.10 specified by the PCI are the minimum controls that must be applied, and organizations should include relevant secure coding practices as applicable to the specific technology in their environment.<\/p>\n\n\n\n<p> <strong><a href=\"https:\/\/pcidssguide.com\/best-practices-and-recommendations-for-api-security\/\">See Also: Best Practices and Recommendations for API Security<\/a><\/strong><\/p>\n\n\n\n<p>Application developers should be appropriately trained to identify and resolve issues with common coding vulnerabilities. Having staff knowledgeable about secure coding guidelines should minimize the number of vulnerabilities caused by poor coding practices.<\/p>\n\n\n\n<p>Training for developers can be provided in-house or by third parties and must be valid for the technology used. As secure coding practices accepted by the industry change, corporate coding practices and developer training should likewise be updated to address new threats.<\/p>\n\n\n\n<p>Be aware of vulnerability trends and include appropriate safeguards in secure coding practices.<\/p>\n\n\n\n<p>Common coding vulnerabilities in software development processes should be addressed as follows:<\/p>\n\n\n\n<ul>\n<li>Software developers are required to receive training at least annually in current secure coding techniques, including how to avoid common coding exploits.<\/li>\n\n\n\n<li>Applications based on secure coding guidelines need to be developed.<\/li>\n<\/ul>\n\n\n\n<p>Up-to-date secure code development methods should be followed by industry best practices such as OWASP Guidelines, SANS CWE Top 25, CERT Secure Coding.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.5.1: Consider injection flaws, specifically SQL injection, also OS Command Injection, LDAP and XPath injection flaws as well as other injection flaws.<\/strong><\/h3>\n\n\n\n<p>Injection flaws, especially SQL injection, are a common method used by attackers to gain unauthorized access to applications. Injection attacks happen when user-supplied data is sent to an interpreter as part of a command or query.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/what-is-sql-injection-how-to-prevent-it\/\">See Also: What is SQL Injection and How to Prevent It?<\/a><\/strong><\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/what-is-os-command-injection-how-to-prevent-it\/\">See Also: What is OS Command Injection and How to Prevent It?<\/a><\/strong><\/p>\n\n\n\n<p><strong><a href=\"http:\/\/www.pcidssguide.com\/what-is-ldap-injection-how-to-prevent-it\/\">See Also: What is LDAP Injection and How to Prevent It?<\/a><\/strong><\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/what-is-xpath-injection-how-to-prevent-it\/\">See Also: What is XPATH Injection and How to Prevent It?<\/a><\/strong><\/p>\n\n\n\n<p>The data provided by the attacker tricks the interpreter into executing unwanted commands or modifying data and allows the attacker to attack components within the network through the application, initiate attacks such as buffer overflows, or expose both confidential information and server application functionality.<\/p>\n\n\n\n<p>Therefore, the information must be verified before sending to the application. For example, data such as all alpha characters, mixes of alpha and numeric characters should be verified by checking, and only the use of required characters should be allowed.<\/p>\n\n\n\n<p>Injection flaws in software development policies and procedures should be addressed with coding techniques including:<\/p>\n\n\n\n<ul>\n<li>Validating user data should not change the meaning of commands and queries.<\/li>\n\n\n\n<li>Parameterized queries should be used.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.5.2: Buffer overflows<\/strong><\/h3>\n\n\n\n<p>A buffer overflow occurs when more data is placed in a buffer reserved for data communication. In short, memory overflow is the overflow situation experienced when data over the planned amount is copied into a limited memory area.<\/p>\n\n\n\n<p>In the case of buffer overflow, attackers can be used to do all kinds of operations if appropriate border controls are not applied. When this happens, the attacker will have the ability to add malicious code to the end of the buffer and then push the malicious code into executable memory space by overflowing the buffer. The malicious code is then run and usually allows the attacker remote access to the application or the infected system.<\/p>\n\n\n\n<p>To avoid buffer overflows, encoding techniques including:<\/p>\n\n\n\n<ul>\n<li>Appropriate boundary controls should be implemented.<\/li>\n\n\n\n<li>Input data must be truncated accordingly.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.5.3: Unsecured cryptographic storage<\/strong><\/h3>\n\n\n\n<p>Applications that do not properly use powerful cryptographic functions to store data are at risk of being exposed and exposing authentication information or cardholder data. If an attacker exploits weak cryptographic processes, they can open encrypted data and gain open access to the data.<\/p>\n\n\n\n<p>Insecure cryptographic storage should be handled with the following coding techniques:<\/p>\n\n\n\n<ul>\n<li>Cryptographic flaws must be prevented.<\/li>\n\n\n\n<li>Strong cryptographic algorithms and keys should be used.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.5.4: Unsecured communications<\/strong><\/h3>\n\n\n\n<p>When network traffic is not sufficiently encrypted by not using strong cryptography, cardholder data is at risk of exposure. If an attacker exploits weak cryptographic processes, they can take control of an application and gain explicitly unencrypted access to weakly encrypted data.<\/p>\n\n\n\n<p>Unsecured communications need to be handled with coding techniques that properly encrypt all sensitive communications.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.5.5: Inappropriate error handling<\/strong><\/h3>\n\n\n\n<p>Applications may inadvertently leak information about their configurations or internal operations, or reveal privileged information through improper error handling. Attackers can use this information to steal sensitive data or access the system.<\/p>\n\n\n\n<p>If a malicious person creates errors that the application does not handle properly, they can obtain detailed system information, create service interruptions, circumvent security measures, or crash the server.<\/p>\n\n\n\n<p>For example, the \u201cwrong password entered\u201d response indicates that the user ID provided to the attacker is correct and that they should focus their efforts solely on the password. In this case, more general error messages such as \u201cData could not be verified\u201d should be used.<\/p>\n\n\n\n<p>Improper error handling should be determined in software development policies, and procedures and error messages should be handled with information-proof coding techniques.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.5.6: All \u201chigh risk\u201d vulnerabilities identified during the vulnerability identification process must be addressed.<\/strong><\/h3>\n\n\n\n<p>All vulnerabilities identified as \u201chigh risk\u201d by an organization\u2019s vulnerability risk rating process, and that could affect the application must be identified and addressed during application development.<\/p>\n\n\n\n<p>Software development policies and procedures need to address \u201chigh risk\u201d vulnerabilities that coding techniques may affect the application as defined in PCI DSS Requirement 6.1.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.5.7: Cross-Site Scripting (XSS)<\/strong><\/h3>\n\n\n\n<p>XSS flaws occur when the application receives data provided by the user without validation. XSS allows client-side code to be injected into web pages viewed by other users.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/what-is-cross-site-scripting-xss-how-to-prevent-it\/\">See Also: What is Cross-Site Scripting (XSS) and How to Prevent It?<\/a><\/strong><\/p>\n\n\n\n<p>With XSS, attackers can capture session information on users\u2019 browsers, modify websites, or run malicious scripts.<\/p>\n\n\n\n<p>For cross-site scripting (XSS) vulnerability in software development policies and procedures, coding techniques should be addressed, including:<\/p>\n\n\n\n<ul>\n<li>The data should not be accepted without validation.<\/li>\n\n\n\n<li>Characters that seem unnecessary should be cut off.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.5.8: Inappropriate access control<\/strong><\/h3>\n\n\n\n<p>A direct object reference occurs when a developer presents a reference to an internal application object, such as a file, directory, database record, or key, as a URL or form parameter. Attackers can change these references to access other unauthorized objects.<\/p>\n\n\n\n<p>Access controls must be applied consistently at the application layer and business logic for all URLs. The only way for an application to protect sensitive functionality is to prevent links or URLs from being viewed by unauthorized users.<\/p>\n\n\n\n<p>Attackers can perform unauthorized actions by directly accessing these URLs. An attacker can enumerate and navigate the directory structure of a website so that they can gain access to unauthorized information and learn more about the functioning of the site for later exploitation.<\/p>\n\n\n\n<p>If user interfaces allow access to unauthorized functions, this access can result in unauthorized persons gaining access to privileged credentials or cardholder data. Only authorized users should be allowed to access direct object references to sensitive resources. Limiting access to data sources will help prevent cardholder data from being made available to unauthorized sources.<\/p>\n\n\n\n<p>Unsafe direct object references in software development policies and procedures, inability to restrict URL access or inappropriate access control, such as directory traversal, should be addressed with coding techniques that include:<\/p>\n\n\n\n<ul>\n<li>Users must be properly authenticated.<\/li>\n\n\n\n<li>Entries should be sanitized.<\/li>\n\n\n\n<li>Internal object references should not be disclosed to users.<\/li>\n\n\n\n<li>User interfaces that do not allow access to unauthorized functions should be designed.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.5.9: Cross-site request forgery (CSRF)<\/strong><\/h3>\n\n\n\n<p>A CSRF attack forces the browser of a logged-on user to send a pre-authenticated request to a vulnerable web application. This way, the attacker can then realize what the victim is authorized to perform.<\/p>\n\n\n\n<p>For example, the attacker can update the user\u2019s account details, make purchases, and even authenticate the application with the CRSF attack.<\/p>\n\n\n\n<p>Software development policies and procedures should address coding techniques that ensure that applications do not rely on authorization credentials and tokens sent automatically by browsers to prevent cross-site request forgery (CSRF).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.5.10: Broken authentication and session management.<\/strong><\/h3>\n\n\n\n<p>Secure authentication and session management prevents unauthorized persons from compromising legitimate account credentials, keys, or session tokens that would allow them to assume the identity of an authorized user.<\/p>\n\n\n\n<p>In software development policies and procedures, broken authentication and session management should be handled with coding techniques that include:<\/p>\n\n\n\n<ul>\n<li>Session tokens (e.g. cookies) should be marked as \u201csecure\u201d.<\/li>\n\n\n\n<li>Session identifications should not be exposed in the URL.<\/li>\n\n\n\n<li>Controls such as appropriate timeouts and rotation of session IDs should be enforced after successful login.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>PCI DSS Requirement 6.6: Constantly address new threats and vulnerabilities for Internet-facing web applications and ensure that these applications are protected from known attacks.<\/strong><\/h2>\n\n\n\n<p>New threats and vulnerabilities must be constantly addressed for web applications open to the Internet, and it must be ensured that these applications are protected against attacks by one of the following methods:<\/p>\n\n\n\n<ul>\n<li>Review web-facing web applications through manual or automated application vulnerability assessment tools or methods, at least annually and after any changes. This assessment is not the same as the vulnerability scans performed for PCI DSS Requirement 11.2.<\/li>\n\n\n\n<li>Install an automated technical solution which detects and prevents attacks on the Web, such as a web application firewall, in front of public web applications to control all traffic continuously.<\/li>\n<\/ul>\n\n\n\n<p>Externally visible web applications are primary targets for attackers, and poorly coded web applications provide an easy way for attackers to gain access to sensitive data and systems.<\/p>\n\n\n\n<p>It aims to reduce the number of threats in public web applications due to the need to review applications or install web application firewalls, poor coding or application management practices.<\/p>\n\n\n\n<p>Manual or automated vulnerability assessment tools or methods can be used to examine or test the application for vulnerabilities. Web application firewalls filter and block unnecessary traffic at the application layer.<\/p>\n\n\n\n<p>When used in conjunction with a network-based firewall, a properly configured web application firewall prevents application-layer attacks if applications are incorrectly coded or configured. A combination of technology and process can achieve complete protection.<\/p>\n\n\n\n<p>Process-based solutions should have mechanisms that facilitate the purpose of this requirement and respond to alerts promptly to prevent attacks.<\/p>\n\n\n\n<p>Also, as long as an organization specializing in application security specializes in application security and can demonstrate independence from the development team, such services can be provided by a third-party company or an internal organization.<\/p>\n\n\n\n<p>For public web applications, it is necessary to make sure that one of the following methods is in effect as follows:<\/p>\n\n\n\n<ul>\n<li>Vulnerability scanning should be conducted at least annually or after any changes.<\/li>\n\n\n\n<li>All identified security gaps must be closed.<\/li>\n\n\n\n<li>Findings should be reconfirmed after corrections.<\/li>\n\n\n\n<li>An application or device must be located in front of public web applications to detect and prevent web-based attacks.<\/li>\n\n\n\n<li>It should work as a device or application and be updated appropriately.<\/li>\n\n\n\n<li>Create a device or application audit logs.<\/li>\n\n\n\n<li>The device or application must be configured to block web-based attacks or generate an alert to be investigated immediately.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>&nbsp;PCI DSS Requirement 6.7: Ensure security policies and operational procedures for developing and maintaining secure systems and applications are documented, in use, and known to all affected parties.<\/strong><\/h2>\n\n\n\n<p>Personnel must be aware of and comply with security policies and operational procedures to ensure that systems and applications are developed securely and are constantly protected from vulnerabilities.<\/p>\n\n\n\n<p>For detailed information, see the <strong><a href=\"https:\/\/www.pcisecuritystandards.org\/documents\/PCI_DSS-QRG-v3_2_1.pdf\">PCI DSS Quick Reference Guide<\/a><\/strong> from the PCI SSC Documentation library.<\/p>\n\n\n\n<p>To review all of the PCI DSS Requirements, you can review our <strong><a href=\"https:\/\/pcidssguide.com\/pci-dss-requirements\/\">PCI DSS Requirements<\/a><\/strong> and <strong><a href=\"https:\/\/pcidssguide.com\/what-is-pci-dss-and-pci-compliance\/\">PCI Compliance<\/a><\/strong> articles.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Unscrupulous people are exploiting bugs to gain privileged access to programs. Many of these bugs are addressed by the manufacturer&#8217;s security patches, which must be implemented by the device-running organizations.<\/p>\n","protected":false},"author":1,"featured_media":355,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[19,28,20],"tags":[54,62,56],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>PCI DSS Requirement 6 Explained - PCI DSS GUIDE<\/title>\n<meta name=\"description\" content=\"PCI DSS Requirement 6 deals with secure software and system development. It also addresses vulnerability and patch management.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"PCI DSS Requirement 6 Explained - PCI DSS GUIDE\" \/>\n<meta property=\"og:description\" content=\"PCI DSS Requirement 6 deals with secure software and system development. It also addresses vulnerability and patch management.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/\" \/>\n<meta property=\"og:site_name\" content=\"PCI DSS GUIDE\" \/>\n<meta property=\"article:published_time\" content=\"2020-04-07T16:39:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-10-09T07:46:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-req-6.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1280\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Surkay Baykara\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Surkay Baykara\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"19 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/\"},\"author\":{\"name\":\"Surkay Baykara\",\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"headline\":\"PCI DSS Requirement 6 Explained\",\"datePublished\":\"2020-04-07T16:39:06+00:00\",\"dateModified\":\"2023-10-09T07:46:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/\"},\"wordCount\":4150,\"publisher\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"image\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-req-6.jpg\",\"keywords\":[\"pci dss\",\"pci dss requirement 6\",\"pci dss requirements\"],\"articleSection\":[\"PCI DSS\",\"PCI DSS Requirement 6\",\"PCI DSS Requirements\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/\",\"url\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/\",\"name\":\"PCI DSS Requirement 6 Explained - PCI DSS GUIDE\",\"isPartOf\":{\"@id\":\"https:\/\/pcidssguide.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-req-6.jpg\",\"datePublished\":\"2020-04-07T16:39:06+00:00\",\"dateModified\":\"2023-10-09T07:46:45+00:00\",\"description\":\"PCI DSS Requirement 6 deals with secure software and system development. It also addresses vulnerability and patch management.\",\"breadcrumb\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/#primaryimage\",\"url\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-req-6.jpg\",\"contentUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-req-6.jpg\",\"width\":1920,\"height\":1280,\"caption\":\"PCI DSS Requirement 6\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/pcidssguide.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"PCI DSS Requirement 6 Explained\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/pcidssguide.com\/#website\",\"url\":\"https:\/\/pcidssguide.com\/\",\"name\":\"PCI DSS GUIDE\",\"description\":\"PCI Compliance Guide For All Business\",\"publisher\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/pcidssguide.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\",\"name\":\"Surkay Baykara\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g\",\"caption\":\"Surkay Baykara\"},\"logo\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/\"},\"description\":\"A passionate Senior Information Security Consultant working at Cyberwise. Over the past 15+ years my professional career has included several positions beginning as a developer and IT administrator, working my way up to a senior Technical Performance Consultant before joining Biznet back in 2015. I had several different roles at Cyberwise, including Penetration Tester and PCI DSS QSA. In my job as a QSA, I found my passion and worked closely with the Audit and Compliance team. I've been working inside InfoSec for over 15 years, coming from a highly technical background. I have earned several certifications during my professional career including; CEH, CISA, CISSP, and PCI QSA.\",\"sameAs\":[\"https:\/\/www.pcidssguide.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"PCI DSS Requirement 6 Explained - PCI DSS GUIDE","description":"PCI DSS Requirement 6 deals with secure software and system development. It also addresses vulnerability and patch management.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/","og_locale":"en_US","og_type":"article","og_title":"PCI DSS Requirement 6 Explained - PCI DSS GUIDE","og_description":"PCI DSS Requirement 6 deals with secure software and system development. It also addresses vulnerability and patch management.","og_url":"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/","og_site_name":"PCI DSS GUIDE","article_published_time":"2020-04-07T16:39:06+00:00","article_modified_time":"2023-10-09T07:46:45+00:00","og_image":[{"width":1920,"height":1280,"url":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-req-6.jpg","type":"image\/jpeg"}],"author":"Surkay Baykara","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Surkay Baykara","Est. reading time":"19 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/#article","isPartOf":{"@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/"},"author":{"name":"Surkay Baykara","@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"headline":"PCI DSS Requirement 6 Explained","datePublished":"2020-04-07T16:39:06+00:00","dateModified":"2023-10-09T07:46:45+00:00","mainEntityOfPage":{"@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/"},"wordCount":4150,"publisher":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"image":{"@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/#primaryimage"},"thumbnailUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-req-6.jpg","keywords":["pci dss","pci dss requirement 6","pci dss requirements"],"articleSection":["PCI DSS","PCI DSS Requirement 6","PCI DSS Requirements"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/","url":"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/","name":"PCI DSS Requirement 6 Explained - PCI DSS GUIDE","isPartOf":{"@id":"https:\/\/pcidssguide.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/#primaryimage"},"image":{"@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/#primaryimage"},"thumbnailUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-req-6.jpg","datePublished":"2020-04-07T16:39:06+00:00","dateModified":"2023-10-09T07:46:45+00:00","description":"PCI DSS Requirement 6 deals with secure software and system development. It also addresses vulnerability and patch management.","breadcrumb":{"@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/pcidssguide.com\/pci-dss-requirement-6\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/#primaryimage","url":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-req-6.jpg","contentUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-dss-req-6.jpg","width":1920,"height":1280,"caption":"PCI DSS Requirement 6"},{"@type":"BreadcrumbList","@id":"https:\/\/pcidssguide.com\/pci-dss-requirement-6\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/pcidssguide.com\/"},{"@type":"ListItem","position":2,"name":"PCI DSS Requirement 6 Explained"}]},{"@type":"WebSite","@id":"https:\/\/pcidssguide.com\/#website","url":"https:\/\/pcidssguide.com\/","name":"PCI DSS GUIDE","description":"PCI Compliance Guide For All Business","publisher":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/pcidssguide.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741","name":"Surkay Baykara","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g","caption":"Surkay Baykara"},"logo":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/"},"description":"A passionate Senior Information Security Consultant working at Cyberwise. Over the past 15+ years my professional career has included several positions beginning as a developer and IT administrator, working my way up to a senior Technical Performance Consultant before joining Biznet back in 2015. I had several different roles at Cyberwise, including Penetration Tester and PCI DSS QSA. In my job as a QSA, I found my passion and worked closely with the Audit and Compliance team. I've been working inside InfoSec for over 15 years, coming from a highly technical background. I have earned several certifications during my professional career including; CEH, CISA, CISSP, and PCI QSA.","sameAs":["https:\/\/www.pcidssguide.com"]}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/253"}],"collection":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/comments?post=253"}],"version-history":[{"count":3,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/253\/revisions"}],"predecessor-version":[{"id":2173,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/253\/revisions\/2173"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/media\/355"}],"wp:attachment":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/media?parent=253"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/categories?post=253"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/tags?post=253"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}