You are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?
Trap 1: Perform a network vulnerability scan
Scanning helps verify security, but it does not define the architectural scope of the CDE.
Trap 2: Review the application source code
Code review is a verification step, not a requirement elicitation methodology.
Trap 3: Update the firewall rule set
Firewall configuration is a technical control, not an elicitation process.
- A
Perform a network vulnerability scan
Why wrong: Scanning helps verify security, but it does not define the architectural scope of the CDE.
- B
Map the data flow of credit card information
Mapping data flows identifies exactly which components interact with sensitive data, defining the compliance scope.
- C
Review the application source code
Why wrong: Code review is a verification step, not a requirement elicitation methodology.
- D
Update the firewall rule set
Why wrong: Firewall configuration is a technical control, not an elicitation process.