This is page 2 of:
A Look at PCI in 2010
Pages: 1 2
January 6th, 2010
PCI Columnist Walt Conway sees PCI 2.0 mandating the use of automated cardholder data discovery tools, will impose rules that will literally overrun the council's PCI training program and will likely not alienate Level 2s enough to make a difference. (That's the secret to a happy marriage, knowing the precise moment that an aggravation level will overtake apathy and stopping nanoseconds short of it.)
But Conway sees the data discovery prediction the most significant. "If you have a lot of locations, you have work to do setting up and scanning all those databases, workstations and servers. Especially watch to see if the Council decides to implement data discovery like it did wireless scanning (Requirement 11.1). If this happens, merchants will not be able to sample locations and will have to search each one. The good news is that you can conduct these searches internally and there are good open source products available. Your QSA likely would only need to verify the results of your automated discovery and to review the scope of your search."
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
Pages: 1 2
5 Comments | Read A Look at PCI in 2010
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Ed
January 7th, 2010 at 11:39 am
Is anyone seeing movement towards revoking the “free pass” for transferring data unencrypted over private networks? In both Heartland and Hannaford data was being sniffed “on-the-fly”. Will the continuing trend towards malware-based data collection attacks drive the council to consider requiring the encryption of data “in flight”?
January 7th, 2010 at 12:26 pm
Anyone else here reading “I.T. WARS”? I had to read parts of this book as part of my employee orientation at a new job. The book talks about a whole new culture as being necessary – an eCulture – for a true understanding of security, being that most identity/data breaches are due to simple human errors. It has a great chapter on security. Just Google “IT WARS” – check out a couple links down and read the interview with the author David Scott. (Full title is “I.T. WARS: Managing the Business-Technology Weave in the New Millennium”).
January 7th, 2010 at 7:10 pm
@Dave,
The focus of DSS is data at rest, but as you observe, data in transit can be vulnerable. Like you, I would not be surprised to see some move by the Council addressing unencrypted data over private/internal networks. I just don’t know when. I can think of two arguments for sooner rather than later. First, they update the DSS to reflect current attack vectors, which as you point out applies here. Second, the Council is looking at “emerging technologies,” a couple of which can in theory address this issue.
Will PCI DSS reflect this as a new requirement? I’d say it will someday. The uncertainty is when that day will be. Merchants and processors truly interested in security will address this issue without waiting for the Council to mandate it.
January 8th, 2010 at 3:46 pm
Interesting article. I’m curious. What happens to the PA-DSS validation status of a payment application once the Security Council implements a new standards version? Does it have to be re-validated under the new standard in order to remain compliant? It was my understanding that an application would remain compliant and acceptable for new deployments until it hits the re-validation date listed on the Security Councils web-site for that application even if a new standard was issued. Once that date is reached, it would then have to be re-validated under the current standard. Is this a correct interpretation?
January 30th, 2010 at 6:35 pm
Don,
Thanks for your comment and question. My understanding is the same as yours. That is, you would revalidate your app against the new/revised PA-DSS when you next assessed, whether that is at the current expiry date, or when you either introduce a new version or make a significant change to the app. Don’t forget those last two events, either which triggers a revalidation.