In case you missed it, the PCI Security Standards Council (SSC) published the initial release of the much anticipated Point-to-Point Encryption Solution (P2PE) Requirements document last month. Many of you are probably asking, “Why do I care?” – a good question in a day and age with so much information and noise. If you’ll allow me, I’d like to answer two better questions! But first, to answer, this document is significant because it is at the heart of the fiery topic of PCI scope.Read more
Vulnerability scanning. Mention those two words, and your IT operations staff usually shudders. Conversely, your IT audit/security staff usually start doing a happy dance (I think those guys are sadists, like Steve Martin in Little Shop of Horrors.) Love it or hate it, vulnerability scanning is required by many compliance regimens. The PCI DSS states that you have to perform vulnerability scanning quarterly, and from both an external and internal perspective. If you follow the letter of the PCI law, that’s at least eight scans a year. I would like to posit that if you’re really doing PCI vulnerability scanning correctly, it’s more like a minimum of 12 scans each year, with 16 being the better number.Read more
Security is expensive. We all know that. I see the battles my clients continually face – particularly the small and medium-sized businesses (SMBs) – as they try to spread their limited security dollars across dedicated salaries (for the fortunate ones), toolsets, appliances, training, and consulting (maybe we don’t need to include the last one…). The underlying belief that many SMBs seem to receive some relief from: “I’m the small guy. Surely I won’t be targeted when there are banks and multinational retailers to be hacked.” Mr. Angelastri says as much in this Wall Street Journal article.Read more
Today, the PCI SSC finally released tokenization guidelines. Nothing too surprising in the guidelines, but they did bring up several interesting points. One of my favorites is:
“When evaluating a tokenization system, it is important to consider all elements of the overall tokenization solution. These include the technologies and mechanisms used to capture cardholder data and how a transaction progresses through the merchant environment, including transmission to the processor/acquirer. The tokenization solution should also address potential attack vectors against each component and provide the ability to confirm with confidence that associated risks are addressed.”Read more
In True’s experience as a QSA advising merchants with PCI compliance, one point of confusion seems to always surface – when are merchants required to use a Payment Application Data Security Standard (PA-DSS) validated POS application?
First, it is important to understand that the Payment Card Industry Data Security Standard (PCI-DSS) and PA-DSS are completely separate standards. Assessors do not validate or require PA-DSS when validating PCI-DSS. All applicable PCI-DSS controls must always be evaluated regardless of the POS validation status. Utilizing a PA-DSS application allows merchants to ensure that the application was designed to meet the PCI security requirements.Read more
