Auditing ASP.NET applications for PCI DSS compliance

According to the 2010 Data Breach Investigation Report published by Verizon Business (2010), 40% of all the data breaches were the result of hacking attacks, out of that 40%, 54% were related to web applications. Application security remains one of the key factors in avoiding a security breach. PCI DSS (Payment Card Industry Data Security Standard) recognizes this and specific requirements have been outlined to ensure that companies have processes in place to ensure that applications are developed, deployed, and maintained securely. This paper intends to provide specific guidance to audit ASP.NET applications and verify that they meet PCI DSS requirements.