PCI DSS version 4.0 contains a host of new practices that will become requirements on March 31, 2025. In this talk, we focus on a change that looks — at first glance — to be minor, but in reality could have significant implications for Application Security teams: the requirement to manage all internal vulnerabilities, regardless of criticality.
We’ll focus on how to address open source software (OSS) vulnerabilities, including:
- What it means to “manage vulnerabilities”
- Why OSS presents the greatest risk to compliance with this new requirement
- The security tool problem preventing organizations from addressing OSS risk
- Getting accurate dependency inventories and prioritizing remediation
- Setting up guardrails to ensure developers select safe OSS dependencies