Control: Information involved in application service transactions shall be protected to prevent incomplete transmission, mis-routing, unauthorized message alteration, unauthorized disclosure, unauthorized message duplication or replay.
Could you please tell me what exactly are “application services transactions”, with a practical example ?
I googled it a bit but I cannot find any satisfactory explanation.
Answer: "Application services transactions" are basically all information exchanged between systems in a client-service structure (where part of the system is under control of the user, the other is under control of the application owner, and both are interconnected by a communication link).
Practical examples are Internet banking applications, social networks, corporate systems remotely accessed, etc.
This control is incuding two items involving "message" as 1)how unauthorized message alteration will be prevented 2)how unauthorized message duplication will be prevented. Does it mean those two items are required if your appliaction has a capability to send messages?
Please note that these items must be implemented only if: - There are unacceptable risks demanding the implementation of the items - There are legal requirements demanding the implementation oitemsf the - There is a top management decision demanding the implementation of the items
If none of the above occurs, you do not need to implement these items.
Considering that, you have to verify what of the above conditions occurs to each item to define which one, or both, will be implemented.