Requirement 6.6 is also concerned with the security of web applications,
but this time just public-facing web applications,
not web applications that are just used internally,
just ones that are public facing, connected to the internet,
and that is because of the additional risk associated with the web application
that's accessible and attackable by anyone on the internet.
This requirement demands that there's another layer of protection in place,
and PCI DSS gives two options for this additional layer of protection.
The first is that all web applications have a separate
security view by an external organization that specializes
in secure application review, and this could be an automated review.
So here the standard is really looking for things like dynamic code analysis,
automated application vulnerability testing like fuzzing on auto testers,
and as the standard knows, this is not a simple normal vulnerability scan,
and it also needs to be carried out by an external specialist organization.
It doesn't have to be any organization approved by the PCI SSE,
but it has to be an organization that's a
specialist at doing secure code reviews.
The other option if you don't want to do that is to install a web application
firewall between the internet and your web application.
Personally,
even though the standard gives you the choice of using either
of these two added layers of protection,
I would always use both for high-value, public-facing web assets.
If you've chosen to go with the external vulnerability assessment,
then the QSA is going to check the process documentation,
check that the assessment is done by an external specialist organization,
check that all of the vulnerabilities in requirement 6.5 are checked for,
and that any vulnerabilities found are fixed and the
application retested after the fix has been applied.
They're also going to interview people and more importantly look for
documentary evidence this process is really being followed.
On the other hand, if you've chosen to display a web application firewall,
which most people call a WAF,
the QSA is going to look at the operation and configuration
of the WAF and also interview people responsible for the
application firewall's operation.
The QSA should check that there's no root from the internet to
the web application that bypasses the WAF,
and a good QSA will also try the types of activity that should be
blocked by the WAF to make sure it's working correctly.
A really good QSA is also going to check that that WAF
is properly writing to the log files.